What does "Copy clean link" mean?(support.brave.com)
support.brave.com
What does "Copy clean link" mean?
https://support.brave.com/hc/en-us/articles/9982188779405-What-does-Copy-clean-link-mean-
268 comments
This is the same browser that did the opposite before: injecting their own referral parameter in links.
I'm honestly surprised by the disingenuity of comments like these. Hiding facts on purpose, jumping on the hate train and twisting the situation to make a FOSS browser look bad.
I'm reposting my comment from a few days ago: https://news.ycombinator.com/item?id=34919771#34939391
> It wasn't 'caught' with anything, as much as those spicy news articles would have you believe. It was a URL suggestion bug. It was supposed to be turned off by default, and suggest content instead of replacing it.
The bug was fixed in a day after release, the PR is on GitHub. Brave is open source, unlike Chrome and Edge. Let's stop treating FOSS like the other spyware.
This also happened when Brave was like 5 months old. The feature since then has been turned off by default and the affiliate thing was shut down a long ago.
I'm reposting my comment from a few days ago: https://news.ycombinator.com/item?id=34919771#34939391
> It wasn't 'caught' with anything, as much as those spicy news articles would have you believe. It was a URL suggestion bug. It was supposed to be turned off by default, and suggest content instead of replacing it.
The bug was fixed in a day after release, the PR is on GitHub. Brave is open source, unlike Chrome and Edge. Let's stop treating FOSS like the other spyware.
This also happened when Brave was like 5 months old. The feature since then has been turned off by default and the affiliate thing was shut down a long ago.
This is Brave's official response on the affiliate link matter:
https://brave.com/referral-codes-in-suggested-sites/
So they did intend to put affiliate links into suggestions, and the bug was that it was accidentally applied to autocomplete in the URL bar based on the first suggestion.
I think the original intention was shady enough. It's good that they changed direction on this, but the damage on their reputation is well justified in my opinion.
https://brave.com/referral-codes-in-suggested-sites/
So they did intend to put affiliate links into suggestions, and the bug was that it was accidentally applied to autocomplete in the URL bar based on the first suggestion.
I think the original intention was shady enough. It's good that they changed direction on this, but the damage on their reputation is well justified in my opinion.
> So they did intend to put affiliate links into suggestions, and the bug was that it was accidentally applied to autocomplete in the URL bar based on the first suggestion.
and I fail to see how is that a 'threat to privacy' or something so outrageous that people are still holding a grudge after years.
Firstly, the feature was off by default, so that those who wanted to support Brave could enable it.
Secondly, the affiliate thing was only supposed to suggest the link and not replace it. Hence, the 'bug'.
Thirdly, this was not a privacy risk in any way. The affiliate link were only suggested for a few crypto websites and nothing else.
Fourthly, the bug was fixed in day. Years ago. Affiliate thing was shut down instantly and since then, nothing of that sort has been tried by Brave.
> I think the original intention was shady enough
Then I guess Firefox providing Google search as default, without asking you is shady too? or Firefox installing a whole extension for Mr.Robot without asking its users was shady too? what about Pocket? Featuring articles from partners.
I still don't see the outrage.
and I fail to see how is that a 'threat to privacy' or something so outrageous that people are still holding a grudge after years.
Firstly, the feature was off by default, so that those who wanted to support Brave could enable it.
Secondly, the affiliate thing was only supposed to suggest the link and not replace it. Hence, the 'bug'.
Thirdly, this was not a privacy risk in any way. The affiliate link were only suggested for a few crypto websites and nothing else.
Fourthly, the bug was fixed in day. Years ago. Affiliate thing was shut down instantly and since then, nothing of that sort has been tried by Brave.
> I think the original intention was shady enough
Then I guess Firefox providing Google search as default, without asking you is shady too? or Firefox installing a whole extension for Mr.Robot without asking its users was shady too? what about Pocket? Featuring articles from partners.
I still don't see the outrage.
> Firstly, the feature was off by default, so that those who wanted to support Brave could enable it.
From the same Brave response:
> We have already fixed the issue in Brave’s open source on GitHub and in the Brave Nightly, Beta, and Developer release channels, as well as in the Stable (1.9.80) release of our desktop browser that just went live, by changing the “Show Brave suggested sites in autocomplete suggestions” setting’s default to “off”.
So no, unless I read it wrong, it was not off by default.
> Then I guess Firefox providing Google search as default, without asking you is shady too? or Firefox installing a whole extension for Mr.Robot without asking its users was shady too? what about Pocket? Featuring articles from partners.
Yes, Firefox also did a lot of shady stuff. Also mistakes of Mozilla doesn't absolve Brave from their own mistakes.
Google search being the default in Firefox is blatantly obvious, they don't try to hide it. Compare it to the affiliate link suggestion screenshot:
https://brave.com/static-assets/images/optimized/referral-co...
Yeah, there is absolutely no indication that this is an affiliate link suggested by Brave. It was clearly meant to fly under the radar.
There might be no privacy concerns here, but I still think this is a bit shady.
From the same Brave response:
> We have already fixed the issue in Brave’s open source on GitHub and in the Brave Nightly, Beta, and Developer release channels, as well as in the Stable (1.9.80) release of our desktop browser that just went live, by changing the “Show Brave suggested sites in autocomplete suggestions” setting’s default to “off”.
So no, unless I read it wrong, it was not off by default.
> Then I guess Firefox providing Google search as default, without asking you is shady too? or Firefox installing a whole extension for Mr.Robot without asking its users was shady too? what about Pocket? Featuring articles from partners.
Yes, Firefox also did a lot of shady stuff. Also mistakes of Mozilla doesn't absolve Brave from their own mistakes.
Google search being the default in Firefox is blatantly obvious, they don't try to hide it. Compare it to the affiliate link suggestion screenshot:
https://brave.com/static-assets/images/optimized/referral-co...
Yeah, there is absolutely no indication that this is an affiliate link suggested by Brave. It was clearly meant to fly under the radar.
There might be no privacy concerns here, but I still think this is a bit shady.
> So no, unless I read it wrong, it was not off by default.
I wrote it wrong. The feature was 'turned' off by default after that bug.
> Compare it to the affiliate link suggestion screenshot:
Suggestion is not what's wrong. The suggestion replacing the URL was what was wrong.
> It was clearly meant to fly under the radar.
Just like how the rest of the things like Brave News, Brave Talk or Brave Search do. I don't see an issue here? They don't force a lot of stuff in your face, it's evident to anyone who uses the browser. They keep most things off by default, that's what their strategy has become.
When it was not the case (when the browser was like 5 months old), it was changed. I don't see why people are still holding it against them?
> There might be no privacy concerns here, but I still think this is a bit shady.
I don't think it was shady because, as discussed, it was a bug that was acknowledged by them, and they not only removed the affiliate links but also turned the auto-suggest feature off by default. https://github.com/brave/brave-core/commit/e8fdde70a3ac2c25e...
Now, it's up to your interpretation to classify this as shady or not, but I personally don't think this was as big of a deal. People still holding on to it is the reason I cannot take these comments seriously. Edge and Chrome with all that spyware are most HN users' favorite browsers.
I wrote it wrong. The feature was 'turned' off by default after that bug.
> Compare it to the affiliate link suggestion screenshot:
Suggestion is not what's wrong. The suggestion replacing the URL was what was wrong.
> It was clearly meant to fly under the radar.
Just like how the rest of the things like Brave News, Brave Talk or Brave Search do. I don't see an issue here? They don't force a lot of stuff in your face, it's evident to anyone who uses the browser. They keep most things off by default, that's what their strategy has become.
When it was not the case (when the browser was like 5 months old), it was changed. I don't see why people are still holding it against them?
> There might be no privacy concerns here, but I still think this is a bit shady.
I don't think it was shady because, as discussed, it was a bug that was acknowledged by them, and they not only removed the affiliate links but also turned the auto-suggest feature off by default. https://github.com/brave/brave-core/commit/e8fdde70a3ac2c25e...
Now, it's up to your interpretation to classify this as shady or not, but I personally don't think this was as big of a deal. People still holding on to it is the reason I cannot take these comments seriously. Edge and Chrome with all that spyware are most HN users' favorite browsers.
This is exactly what I meant, and isn't something "accidental".
To be fair, seemed to be by mistake and quickly corrected. They also issued an apoogy.
(disclamer: I still use Firefox and recomend you do so as well).
(disclamer: I still use Firefox and recomend you do so as well).
The mistake was getting caught? Eich’s initial response was that was intentional and ethical. Until it went viral and his view evolved. Granted, I’m not too keen to give him or Brave much benefit of doubt.
https://twitter.com/BrendanEich/status/1269289242905042944
https://twitter.com/BrendanEich/status/1269289242905042944
Doesn’t look like it was a privacy problem nor does it look like he claimed it was “by mistake”.
Seems perfectly reasonable to me and everyone over reacted so they took it off.
Seems perfectly reasonable to me and everyone over reacted so they took it off.
He did say it was a mistake later[0]:
> 1/ We made a mistake, we're correcting
[0] https://twitter.com/BrendanEich/status/1269313200127795201
> 1/ We made a mistake, we're correcting
[0] https://twitter.com/BrendanEich/status/1269313200127795201
The distinction I was making here was "by mistake" versus "done on purpose but acknowledging it was either done poorly or the wrong thing to do".
OP said "Mistake was getting caught" which to me implies that he is using the word "mistake" to reduce accountability rather than increase it. I think it's the latter: he's using the word "mistake" to take responsibility for having made a decision his users disagree with (whether or not it's objectively bad, I think is a moot point given the backlash from users).
Same clarification he makes in this tweet:
"I think you used "mistake" where you meant "accident". I never said it was accidental. We were treating it like a search query (which all big browsers do tag with an affiliate id to get paid from by the search provider). But a valid domain name is not a search query. Fixing."
https://twitter.com/BrendanEich/status/1269421487011713030?s...
OP said "Mistake was getting caught" which to me implies that he is using the word "mistake" to reduce accountability rather than increase it. I think it's the latter: he's using the word "mistake" to take responsibility for having made a decision his users disagree with (whether or not it's objectively bad, I think is a moot point given the backlash from users).
Same clarification he makes in this tweet:
"I think you used "mistake" where you meant "accident". I never said it was accidental. We were treating it like a search query (which all big browsers do tag with an affiliate id to get paid from by the search provider). But a valid domain name is not a search query. Fixing."
https://twitter.com/BrendanEich/status/1269421487011713030?s...
If you read the full thing he's saying the autocomplete should not have filled in a referral code, only typing in the full address.
It's the same thing as when FireFox adds it's referral code when going to Google Search, I believe that's most of their revenue...
TLDR: the bug was the referral code was being added in the autocomplete. It should have only been added to the exact affiliate address, such as "binance.us".
It's the same thing as when FireFox adds it's referral code when going to Google Search, I believe that's most of their revenue...
TLDR: the bug was the referral code was being added in the autocomplete. It should have only been added to the exact affiliate address, such as "binance.us".
Exactly, it was a bug that was fixed in a single day after release, years ago! Some are still mad at Brave releasing a bug, as if other browser are flawless.
Based on that thread, and some long-ago history with affiliate marketing, I would bet a small sum that they're still doing similar today. They're just hiding it better.
Seems like it was just indicating "our autocorrect is how the user got here" and there are certainly a LOT of other ways a browser could communicate that far, far more sneakily.
Isn’t that what the the referrer header is for?
The referrer header is for site to site, not directly from browser.
The browser injecting a referrer header seems less transparent than it being in the link, no?
The browser injecting a referrer header seems less transparent than it being in the link, no?
Can you explain how it's not a privacy problem?
They included Brave's affiliate ID, not the users. I think. So, it didn't reveal anything "new' (for fingerprinting) or anything that can identify the user.
Seems like they wanted to hold the data for themselves and backtracked because " Sorry we got caught"
> Seems like they wanted to hold the data for themselves
Hold what data? The affiliate ID?
Hold what data? The affiliate ID?
Brave could know the user... used Brave?
If we're buying in that "by mistake" nonsense we're being so incredibly naive. How can someone even programatically inject referral links in your page "by mistake"?
I've seen too many instances like Google Chrome still tracking you in incognito where companies just come back with they were doing it "by mistake" to believe any of them were really saying the truth.
I've seen too many instances like Google Chrome still tracking you in incognito where companies just come back with they were doing it "by mistake" to believe any of them were really saying the truth.
They didn't say it was made "by mistake". They said that it was a mistake to add affiliate links, and they are disabling them.
In any case, it doesn't look like it was a privacy issue, they just wanted the affiliate revenue from Binance.
Disclaimer: I am not a Brave user, or in any way affiliated with them.
In any case, it doesn't look like it was a privacy issue, they just wanted the affiliate revenue from Binance.
Disclaimer: I am not a Brave user, or in any way affiliated with them.
Referral links themselves were not the mistake. What they intended:
User types a full url: binance.us -> Brave doesn't suggest shit, user goes to whatever they wrote.
User types a partial url/keyword: binance -> Brave shows a suggestion from a local list of partners that match, with the suggested url being basically binance.us/brave. Not user tracking, just IDing that the click came from a campaign.
What the mistake was:
The user wrote binance.us -> Brave suggested the partnered link when it shouldn't have. That is literally it. And it got fixed within one day.
User types a full url: binance.us -> Brave doesn't suggest shit, user goes to whatever they wrote.
User types a partial url/keyword: binance -> Brave shows a suggestion from a local list of partners that match, with the suggested url being basically binance.us/brave. Not user tracking, just IDing that the click came from a campaign.
What the mistake was:
The user wrote binance.us -> Brave suggested the partnered link when it shouldn't have. That is literally it. And it got fixed within one day.
>Google Chrome still tracking you in incognito
When was this?
When was this?
The lawsuit [0][1] was filed in 2020.
[0] https://dockets.justia.com/docket/california/candce/5:2020cv...
[1] https://www.reuters.com/article/us-alphabet-google-privacy-l...
[0] https://dockets.justia.com/docket/california/candce/5:2020cv...
[1] https://www.reuters.com/article/us-alphabet-google-privacy-l...
That's not what the lawsuit says at all.
The lawsuit doesn't say Chrome is doing anything. It's claiming that websites, including those owned by Google, are tracking things in incognito sessions. This is because there is no flag that says "this is an incognito session" sent to the site, and the existence of any such flag would be a bug. There's a constant arms race between sites trying to detect incognito and browsers closing the holes.
The lawsuit doesn't say Chrome is doing anything. It's claiming that websites, including those owned by Google, are tracking things in incognito sessions. This is because there is no flag that says "this is an incognito session" sent to the site, and the existence of any such flag would be a bug. There's a constant arms race between sites trying to detect incognito and browsers closing the holes.
Hmm, not sure it's too likely that sites can differentiate between first time visitors and Incognito / Private browsing, unless they tested for behavior that first time visitors shouldn't be able to do, like signing in (even then that could be a different device, or they might have cleared cookies). In general I would expect most sites to be less interested in identifying Incognito than ad blockers?
There are entire businesses built around this:
https://fingerprint.com/blog/incognito-mode-detection/
Plenty of sites try to do this.
https://www.theverge.com/2019/2/18/18229124/chrome-incognito...
https://fingerprint.com/blog/incognito-mode-detection/
Plenty of sites try to do this.
https://www.theverge.com/2019/2/18/18229124/chrome-incognito...
> How can someone even programatically inject referral links in your page
that is not what happened.
on my google keyboard, "fuck" autocompletes to "duck" but I'm not claiming any grand conspiracy unless it was a duckduckgo keyboard.
that is not what happened.
on my google keyboard, "fuck" autocompletes to "duck" but I'm not claiming any grand conspiracy unless it was a duckduckgo keyboard.
In what way did it "seem to be by mistake"?
Brendan Eich is literally the guy who normalized letting websites run code on your machine. Even if we generously assume his intentions are good, the kind of thinking that brought us JavaScript is not even capable of grokking what I want from my browser in terms of privacy, security, and respect for my attention. Even if Brave's commitments to these values is genuine and not just marketing, they simply don't know what those values mean. Even if you trust their intentions, you can't trust their execution.
They started, right off the bat, by getting in bed with advertisers. That's their revenue stream. That's not how you fund a browser that serves users, that's how you fund a browser that serves advertisers. Even if their intentions are good, they don't know how to execute them.
"Mistakes" like injecting redirects into links are exactly what I'd expect Brave to do intentionally, not something I'd assume is a mistake.
Brendan Eich is literally the guy who normalized letting websites run code on your machine. Even if we generously assume his intentions are good, the kind of thinking that brought us JavaScript is not even capable of grokking what I want from my browser in terms of privacy, security, and respect for my attention. Even if Brave's commitments to these values is genuine and not just marketing, they simply don't know what those values mean. Even if you trust their intentions, you can't trust their execution.
They started, right off the bat, by getting in bed with advertisers. That's their revenue stream. That's not how you fund a browser that serves users, that's how you fund a browser that serves advertisers. Even if their intentions are good, they don't know how to execute them.
"Mistakes" like injecting redirects into links are exactly what I'd expect Brave to do intentionally, not something I'd assume is a mistake.
All browsers deal in advertising, it's the only way to make money on a free product.
And if you don't want the JS that Eich created to run in your browser, you can turn it off... most people like to run sandboxed code instead of installing native programs.
Mozilla makes most of their money from Google Search referrals.
Chrome was entirely built to put more eyeballs on Google ads and track you.
There's a lot more privacy features built into Brave than there are in other browsers. It's user oriented, not adtech oriented.
Of Brave, Chrome, and Firefox, who has the built in ad blocker?
And if you don't want the JS that Eich created to run in your browser, you can turn it off... most people like to run sandboxed code instead of installing native programs.
Mozilla makes most of their money from Google Search referrals.
Chrome was entirely built to put more eyeballs on Google ads and track you.
There's a lot more privacy features built into Brave than there are in other browsers. It's user oriented, not adtech oriented.
Of Brave, Chrome, and Firefox, who has the built in ad blocker?
> All browsers deal in advertising, it's the only way to make money on a free product.
That's a pretty confidently wrong statement.
You're aware of Wikipedia, right? More directly relevant: Konqueror?
And as is typical of HN, you seem to be unaware that people might be motivated by things other than money. Browsers are a large enough undertaking that you need some money to make one sustainably, but when money isn't your primary motivation it turns out you can do quite a bit with less.
> There's a lot more privacy features built into Brave than there are in other browsers. It's user oriented, not adtech oriented.
Brave is literally adtech. They sell ads.
That's a pretty confidently wrong statement.
You're aware of Wikipedia, right? More directly relevant: Konqueror?
And as is typical of HN, you seem to be unaware that people might be motivated by things other than money. Browsers are a large enough undertaking that you need some money to make one sustainably, but when money isn't your primary motivation it turns out you can do quite a bit with less.
> There's a lot more privacy features built into Brave than there are in other browsers. It's user oriented, not adtech oriented.
Brave is literally adtech. They sell ads.
You got pedantic instead of replying to my overall point.
To take a step back, which browser do you use? Did it come with an ad blocker?
Do you apply these same standards to all browsers and fiercely challenge them like Brave, let's say... Firefox?
To take a step back, which browser do you use? Did it come with an ad blocker?
Do you apply these same standards to all browsers and fiercely challenge them like Brave, let's say... Firefox?
I'm challenging the claim that Brave is somehow better, when in fact it's a step back.
> Do you apply these same standards to all browsers and fiercely challenge them like Brave, let's say... Firefox?
Firefox doesn't claim that they're trying to address the problem of ads on the internet, so no, I don't challenge Firefox's false claims. See how that works?
> Do you apply these same standards to all browsers and fiercely challenge them like Brave, let's say... Firefox?
Firefox doesn't claim that they're trying to address the problem of ads on the internet, so no, I don't challenge Firefox's false claims. See how that works?
https://imgur.com/a/p4CVBHb
"Power and privacy to the people. No need to dig into your security settings. Fierce privacy is our default."
- Firefox on a recent update. You know, a browser that defaults to Google search and having search suggestions on. I know I'd have a couple privacy settings to change.
"Power and privacy to the people. No need to dig into your security settings. Fierce privacy is our default."
- Firefox on a recent update. You know, a browser that defaults to Google search and having search suggestions on. I know I'd have a couple privacy settings to change.
> All browsers deal in advertising, it's the only way to make money on a free product.
I don't want my browser to be a "product". If we didn't have people pushing for exponentially increasing complexity because they want the web to be an app platform then we could have browsers developed by individuals or groups in their free time.
But even if you insist on full time developers, there are alternative funding methods. Donations & grants being the most appropriate for something that benefits the general public.
> And if you don't want the JS that Eich created to run in your browser, you can turn it off... most people like to run sandboxed code instead of installing native programs.
The problem isn't being able to run sandboxed programs vs. native programs, the problem is that things that are supposed to be documents can run "sandboxed" programs where the sandbox is leaky and getting more leaks addded because perfect sandboxing is not what you want for applications that are supposed to be usable and therefore need to interact with the outside world.
Pointing at other browsers and pretending that them being ad-funded and/or also doing bad things makes any thing Brave does better is ridiculous.
I don't want my browser to be a "product". If we didn't have people pushing for exponentially increasing complexity because they want the web to be an app platform then we could have browsers developed by individuals or groups in their free time.
But even if you insist on full time developers, there are alternative funding methods. Donations & grants being the most appropriate for something that benefits the general public.
> And if you don't want the JS that Eich created to run in your browser, you can turn it off... most people like to run sandboxed code instead of installing native programs.
The problem isn't being able to run sandboxed programs vs. native programs, the problem is that things that are supposed to be documents can run "sandboxed" programs where the sandbox is leaky and getting more leaks addded because perfect sandboxing is not what you want for applications that are supposed to be usable and therefore need to interact with the outside world.
Pointing at other browsers and pretending that them being ad-funded and/or also doing bad things makes any thing Brave does better is ridiculous.
If the EU was interested in privacy instead of violating privacy (privacy can be the "right to be left alone", e.g. not be harassed by door-to-door salespeople, cookie popups, etc.) it would have either fully funded Firefox or forked Firefox and fully funded it a long time ago.
JS wasn't alone in the '90s, MS did VBScript in response. This genie was not going back in the bottle, even ignore Java, ActiveX, etc.
Brave private ads system is off by default. Users enable it voluntarily and get 70% of the gross without any data on our servers. Ad matching is done via a pushed ad catalog and local-to-browser machines learning. Impression counting for revshare payments uses a Chaumian blind signature protocol (same crypto as Privacy Pass). If I cold-read your comment here, I get the impression you think Brave's ads are on by default, or you want to leave that impression on readers. It's false.
We also do not inject ads into pages. The opt-in private ads go in your ad slots (notifications, new tab pages), not in any publisher slots.
Your last paragraph (a few other HN regulars do this too) uses dishonest language: "links" mean hyperlinks in pages, and we never added any affiliate code to those. https://news.ycombinator.com/item?id=31088549
Brave private ads system is off by default. Users enable it voluntarily and get 70% of the gross without any data on our servers. Ad matching is done via a pushed ad catalog and local-to-browser machines learning. Impression counting for revshare payments uses a Chaumian blind signature protocol (same crypto as Privacy Pass). If I cold-read your comment here, I get the impression you think Brave's ads are on by default, or you want to leave that impression on readers. It's false.
We also do not inject ads into pages. The opt-in private ads go in your ad slots (notifications, new tab pages), not in any publisher slots.
Your last paragraph (a few other HN regulars do this too) uses dishonest language: "links" mean hyperlinks in pages, and we never added any affiliate code to those. https://news.ycombinator.com/item?id=31088549
>Brendan Eich is literally the guy who normalized letting websites run code on your machine. Even if we generously assume his intentions are good, the kind of thinking that brought us JavaScript is not even capable of grokking what I want from my browser in terms of privacy, security, and respect for my attention.
Unbelievable. Now we're to be angry at (or at least, suspicious of) Eich for inventing Javascript? Because... it can used for evil? Is that really a path we should be going down? Is Tim Berners-Lee next? Come on.
>They started, right off the bat, by getting in bed with advertisers. That's their revenue stream. That's not how you fund a browser that serves users, that's how you fund a browser that serves advertisers.
This is similarly disingenuous. They started trying to solve the problem of facilitating an advertising model that respects privacy and rewarding creators (users) with revenue in the form of BAT tokens.
Say what you want about the execution, or the idea in general — but it's a noble goal.
I'm no fan of Eich's politics but your overall framing here is grossly misleading.
Unbelievable. Now we're to be angry at (or at least, suspicious of) Eich for inventing Javascript? Because... it can used for evil? Is that really a path we should be going down? Is Tim Berners-Lee next? Come on.
>They started, right off the bat, by getting in bed with advertisers. That's their revenue stream. That's not how you fund a browser that serves users, that's how you fund a browser that serves advertisers.
This is similarly disingenuous. They started trying to solve the problem of facilitating an advertising model that respects privacy and rewarding creators (users) with revenue in the form of BAT tokens.
Say what you want about the execution, or the idea in general — but it's a noble goal.
I'm no fan of Eich's politics but your overall framing here is grossly misleading.
> Unbelievable. Now we're to be angry at (or at least, suspicious of) Eich for inventing Javascript? Because... it can used for evil? Is that really a path we should be going down? Is Tim Berners-Lee next? Come on.
There is literally no good case for JavaScript. It's literally malware: code that runs on your machine without your explicitly installing it and does things that serves the website, not the user. The fact that it's in a sandbox to limit the harm it can cause is nice, but it doesn't really solve the fundamental problem.
Formats such as social media profiles, recipes, etc., would have been better served as document formats separate from or included in HTML.
More complex things like Google Maps could have been done as native apps--and still are, because the web app simply can't provide the same level of experience as a native app.
> They started trying to solve the problem of facilitating an advertising model that respects privacy and rewarding creators (users) with revenue in the form of BAT tokens.
If I want to reward a creator I can pay them without a middle man: BAT complicates that rather than simplifying it.
Advertising is a social harm. An advertising model that respects privacy, still disrespects attention, bandwidth, power usage, etc.
It should be clear that content creators aren't browser's target users, but since you brought it up: advertising generally creates a race to the bottom which incentivizes low-quality, low-effort content creation which creates a filtering problem: now it's hard to find the high-quality content amid the half-assed AI-generated nonsense. Publications which are high enough quality to be paid for, such as the NYT, have obviously been harmed by ad-based business models becoming the norm.
> Say what you want about the execution, or the idea in general — but it's a noble goal.
Their goal is to make money, and they've set it up so that their goal of making money is dependent on pleasing advertisers, not users.
The noble goals you're claiming simply are not true.
There is literally no good case for JavaScript. It's literally malware: code that runs on your machine without your explicitly installing it and does things that serves the website, not the user. The fact that it's in a sandbox to limit the harm it can cause is nice, but it doesn't really solve the fundamental problem.
Formats such as social media profiles, recipes, etc., would have been better served as document formats separate from or included in HTML.
More complex things like Google Maps could have been done as native apps--and still are, because the web app simply can't provide the same level of experience as a native app.
> They started trying to solve the problem of facilitating an advertising model that respects privacy and rewarding creators (users) with revenue in the form of BAT tokens.
If I want to reward a creator I can pay them without a middle man: BAT complicates that rather than simplifying it.
Advertising is a social harm. An advertising model that respects privacy, still disrespects attention, bandwidth, power usage, etc.
It should be clear that content creators aren't browser's target users, but since you brought it up: advertising generally creates a race to the bottom which incentivizes low-quality, low-effort content creation which creates a filtering problem: now it's hard to find the high-quality content amid the half-assed AI-generated nonsense. Publications which are high enough quality to be paid for, such as the NYT, have obviously been harmed by ad-based business models becoming the norm.
> Say what you want about the execution, or the idea in general — but it's a noble goal.
Their goal is to make money, and they've set it up so that their goal of making money is dependent on pleasing advertisers, not users.
The noble goals you're claiming simply are not true.
>There is literally no good case for JavaScript.
It's one thing to say that Javascript is massively over-relied on (I might even agree) but this is not anywhere close to a serious, well-considered argument. It's a joke.
I'm not interested in engaging further because extremist positions like this indicate that the speaker is not interested in meaningful debate.
It's one thing to say that Javascript is massively over-relied on (I might even agree) but this is not anywhere close to a serious, well-considered argument. It's a joke.
I'm not interested in engaging further because extremist positions like this indicate that the speaker is not interested in meaningful debate.
> > There is literally no good case for JavaScript.
> It's one thing to say that Javascript is massively over-relied on (I might even agree) but this is not anywhere close to a serious, well-considered argument.
Perhaps if you quoted past the first sentence you'd find the serious, well-considered argument you're looking for.
> I'm not interested in engaging further because extremist positions like this indicate that the speaker is not interested in meaningful debate.
Quoting a sentence out of context, calling it extremist, and then exiting without responding to any of the substance of my post makes it look awfully like you aren't interested in whatever you think "meaningful debate" means.
The extremist position is that visiting a website implies consent to the website running arbitrary code on my hardware. The only reason this has become accepted is that it's profitable to powerful people.
> It's one thing to say that Javascript is massively over-relied on (I might even agree) but this is not anywhere close to a serious, well-considered argument.
Perhaps if you quoted past the first sentence you'd find the serious, well-considered argument you're looking for.
> I'm not interested in engaging further because extremist positions like this indicate that the speaker is not interested in meaningful debate.
Quoting a sentence out of context, calling it extremist, and then exiting without responding to any of the substance of my post makes it look awfully like you aren't interested in whatever you think "meaningful debate" means.
The extremist position is that visiting a website implies consent to the website running arbitrary code on my hardware. The only reason this has become accepted is that it's profitable to powerful people.
It wasn't my intent to misrepresent your position — The context is right there for anyone to see.
I didn't see anything you wrote that provides extra nuance to the statement. That is - nothing you wrote softens or modifies the quote. Am I right, or did I miss something? You were pretty clear. You even used "literally".
Sure... you went on to say why you see it like that, but that's not what being "quoted out of context" means. Is there some caveat, exception or nuance you were trying to express that modifies what you meant?
As for why I didn't engage further, let me ask you this — what if I tell you JS provides several good use cases for me and people I know? Will you then agree that some people do find good uses cases for JS or will you try to tell me I'm wrong? My impression so far is the latter.
You see what I mean? There doesn't seem to be any point in engaging.
As for the rest - I have no interest in debating BAT, or the advertising world. We largely agree. My point was simply that you misrepresented their value proposition by insisting there was never even a theoretical benefit to users and creators. It's a non-starter for having a useful conversation IMHO.
I didn't see anything you wrote that provides extra nuance to the statement. That is - nothing you wrote softens or modifies the quote. Am I right, or did I miss something? You were pretty clear. You even used "literally".
Sure... you went on to say why you see it like that, but that's not what being "quoted out of context" means. Is there some caveat, exception or nuance you were trying to express that modifies what you meant?
As for why I didn't engage further, let me ask you this — what if I tell you JS provides several good use cases for me and people I know? Will you then agree that some people do find good uses cases for JS or will you try to tell me I'm wrong? My impression so far is the latter.
You see what I mean? There doesn't seem to be any point in engaging.
As for the rest - I have no interest in debating BAT, or the advertising world. We largely agree. My point was simply that you misrepresented their value proposition by insisting there was never even a theoretical benefit to users and creators. It's a non-starter for having a useful conversation IMHO.
That's a really intentional mistake to make.
Another Firefox user
Another Firefox user
Firefox does all kinds of shady tracking too unfortunately. Really the best option is to use forks of chrome or Firefox if you are concerned with privacy.
[citation needed]
Uh, just go into the settings? It's right there.
Uh. Just spell out your concerns and /why/ you need a fork to address them? Or provide a link that does so.
Because I don't want browsing or other behavior data sent to a third party. Does that really need to be explained?
We don't know what you're referring to. What you haven't is explained is what shady tracking you're accusing Firefox of doing, or what to turn off in the settings. Going into about:config and searching for "shady tracking" returns zero results.
* "Allow Firefox to send technical and interaction data to Mozilla"
* "Allow Firefox to make personalized extension recommendations"
* "Allow Firefox to install and run studies"
* "Block dangerous and deceptive content"
* "Pocket" add-on installed by default.
I don't recall opting in to any of these things when I installed firefox. This isn't some conspiracy or hard to understand concept. They are right there in the settings page, not in the config flags, and I don't understand why it's so difficult to believe this or just look yourself.
* "Allow Firefox to make personalized extension recommendations"
* "Allow Firefox to install and run studies"
* "Block dangerous and deceptive content"
* "Pocket" add-on installed by default.
I don't recall opting in to any of these things when I installed firefox. This isn't some conspiracy or hard to understand concept. They are right there in the settings page, not in the config flags, and I don't understand why it's so difficult to believe this or just look yourself.
Yo, other people aren't inside your head, and don't know what you're thinking. It's obvious to you what you're thinking, but until you say it out loud and communicate with us, I can't know if the "shady tracking" setting you're thinking about is the one about Dns over Https or the ones you mentioned or the fact that it's not all routed via Tor/a VPN. we're willing to believe you, and I'm able to look for myself, but you gotta give us something (which you did, thanks). What's hard to understand is where you are coming from. It's easy for me to believe that Firefox is acting "shady", but saying only that much, and no more, is banal and uninteresting. People are willing to do their homework, but you have to tell them what textbook you're working out of and which chapter you're in. I can't see, over the Internet, your reading history so it's impossible, not just difficult, without any frame of reference, to know what you believe is shady or even where you've looked.
Anyway. why does the installation of the Pocket seem so shady to you? There are a number of other features in the program you just installed that you probably weren't aware of. I mean, I didn't read the full source of Firefox before installing it, so there are many features now on my computer that I didn't know I was getting into when I installed Firefox. Is it the fact that Pocket (which Mozilla bought) has a premium tier that causes you to classify it as "shady"?
Anyway. why does the installation of the Pocket seem so shady to you? There are a number of other features in the program you just installed that you probably weren't aware of. I mean, I didn't read the full source of Firefox before installing it, so there are many features now on my computer that I didn't know I was getting into when I installed Firefox. Is it the fact that Pocket (which Mozilla bought) has a premium tier that causes you to classify it as "shady"?
Yeah fair points.
By my measure, any telemetry sent back that wasn't explicitly opted into is shady. Once data has left my machine, it's out of my control and anything can happen to it.
We may not have time to fully audit the source, but individuals and groups I trust have, and have made forks that cut out this telemetry as well as other potentially unsavory features. One can also monitor network traffic in and out of an a browser app to understand what is being sent.
I'm using Bromite on my phone right now to type this.
By my measure, any telemetry sent back that wasn't explicitly opted into is shady. Once data has left my machine, it's out of my control and anything can happen to it.
We may not have time to fully audit the source, but individuals and groups I trust have, and have made forks that cut out this telemetry as well as other potentially unsavory features. One can also monitor network traffic in and out of an a browser app to understand what is being sent.
I'm using Bromite on my phone right now to type this.
We were interested in what you were talking about and now we know because you've actually said. That's the way this site is supposed to work. Generally considered a good thing when people are interested in what you have to say, putting barriers in the way seems less than an ideal strategy.
So there are five settings that you believe are set to the wrong default. This causes you to mistrust firefox in total and want to use a fork that you deem more trustworthy but haven't mentioned any fork or how you decided that they are more trustworthy.
That is all 100% totally and utterly reasonable and we can take it on board and use it to adjust our views or not now that we know what you're talking about.
Thanks for posting it clearly that is worth the time it takes. The inital comment is mostly noise and in my view, not worth posting.
So there are five settings that you believe are set to the wrong default. This causes you to mistrust firefox in total and want to use a fork that you deem more trustworthy but haven't mentioned any fork or how you decided that they are more trustworthy.
That is all 100% totally and utterly reasonable and we can take it on board and use it to adjust our views or not now that we know what you're talking about.
Thanks for posting it clearly that is worth the time it takes. The inital comment is mostly noise and in my view, not worth posting.
I also have a different definition of shady than he's using. A setting clearly and prominently described on the options is not shady in by book, regardless of the default.
Would I prefer Firefox had different defaults? Yes. But, I will reserve the word shady for the products actually doing shady things like telemetry in Windows that requires jumping through hoops to turn off.
Would I prefer Firefox had different defaults? Yes. But, I will reserve the word shady for the products actually doing shady things like telemetry in Windows that requires jumping through hoops to turn off.
You can view your actual telemetry data shared with Mozilla in your Firefox's about:telemetry page. No website browsing history is sent to Mozilla.
https://support.mozilla.org/en-US/kb/telemetry-clientid
https://support.mozilla.org/en-US/kb/telemetry-clientid
Eich doesn't seem like the sort of person who makes mistakes, preferring to do a PR backtrack after misjudging his audience after comparing them to his own dubious standards. Never the sort who thinks they did something wrong but likes you to think they did.
I don't make mistakes? News to me. This kind of heads-I-win-tails-you-lose argument is circular at bottom: I'm bad because I don't make mistakes so it was intentional; any attempt to correct a mistake is backtracking.
No, it was a mistake. We fixed it. If you expect perfection, stop using Firefox too because Mozilla has made mistakes, including some similar ones. (I don't think they are reasons to stop using Firefox, I'm just applying your fake standard.)
No, it was a mistake. We fixed it. If you expect perfection, stop using Firefox too because Mozilla has made mistakes, including some similar ones. (I don't think they are reasons to stop using Firefox, I'm just applying your fake standard.)
[deleted]
Sadly, that is a standard procedure for many current businesses.
Do things until you get caught, then say it was a mistake and apogolize.
Of course there are real mistakes, but this one was quite difficult to make…
Of course there are real mistakes, but this one was quite difficult to make…
*apology
> without interfering with coarse-grained campaign-level tracking
I often manually scrub campaign-level stuff when sending links to friends just to have nicer, shorter URLs
I often manually scrub campaign-level stuff when sending links to friends just to have nicer, shorter URLs
Why do it only then? I wrote a greasemonkey script that pulls most of those before I can even click on them and resolves many known redirectors. I would release it, but it really is a mess and really only works for me. I assume somebody has released something similar, but I couldn't find anything a few years back when I wanted it so I cobbled it together.
How long ago was this? Is it still the case? And why the flood of comments like this in every Brave thread, but never on Chrome threads? Chrome is purely and unapologetically a portal specifically for supporting an ad network, yet I never see the same sort of comments. At least Brave is upfront about what they are doing.
If you claim to be more ethical than the competition and that's why people should use you, you will be held to a higher ethical standard than that competition. Regardless of whether or not this is right, it is how human psychology has always worked, for all time, so it's weird that anyone is surprised or offended by it (and even more weird to build a business model which depends on people not acting this way).
> And why the flood of comments like this in every Brave thread
For my part in such comments (I think I even managed to catch a snippy reply from Eich once), I believe the Web3 vision is toxic to the possibility of a truly pro-user web, and Brave as a company is up to its eyeballs in the stuff. I've seen a rot of siloing, appropriation, and pervasive monetization consume the web in the past 20 years, and Web3 is basically about "democratizing" that rot instead of stopping it. It's a bit like offering sharecropping as an alternative to serfdom: one can argue all day that it's better (credibly, even!), but it's a far cry from being pro-farmer.
So when Brave stakes out the position of being pro-user and pro-privacy, I don't think it's meant in the ways that matter to me, and that feels like a kind of dishonesty. It's not that I envision the Brave C-suite gleefully rubbing their hands together like mustachioed cartoon villains at the prospect of deceiving people like me, but neither do I feel like they're being fully candid about the aims and implications of their project. In short, one might reasonably accuse me of viewing Brave's initiatives through thorn-colored glasses, but I think I came by it honestly.
For my part in such comments (I think I even managed to catch a snippy reply from Eich once), I believe the Web3 vision is toxic to the possibility of a truly pro-user web, and Brave as a company is up to its eyeballs in the stuff. I've seen a rot of siloing, appropriation, and pervasive monetization consume the web in the past 20 years, and Web3 is basically about "democratizing" that rot instead of stopping it. It's a bit like offering sharecropping as an alternative to serfdom: one can argue all day that it's better (credibly, even!), but it's a far cry from being pro-farmer.
So when Brave stakes out the position of being pro-user and pro-privacy, I don't think it's meant in the ways that matter to me, and that feels like a kind of dishonesty. It's not that I envision the Brave C-suite gleefully rubbing their hands together like mustachioed cartoon villains at the prospect of deceiving people like me, but neither do I feel like they're being fully candid about the aims and implications of their project. In short, one might reasonably accuse me of viewing Brave's initiatives through thorn-colored glasses, but I think I came by it honestly.
I would expect it's because Brave advertises itself as being privacy friendly. If you use Chrome you know what you're getting, if you use a browser that claims to be focused on privacy you expect better.
> I would expect it's because Brave advertises itself as being privacy friendly
Yet the bug was not an privacy issue.
Brave still is the most private mainstream browsers. Bugs that were fixed do not reflect the present reality: https://privacytests.org/
Yet the bug was not an privacy issue.
Brave still is the most private mainstream browsers. Bugs that were fixed do not reflect the present reality: https://privacytests.org/
[deleted]
People love to nitpick, and hypocrisy is always perceived as worse than just doing bad things even when the bad things are much worse than the thing they did that's hypocritical.
Perfect is the enemy of good and all that jazz. It's basically impossible to try to be a good actor/explain a good thing without HNers throwing whataboutisms at you.
Of course maybe Brave is actually a bad actor, but none of the things people are calling them out for are meaningful evidence of that. The thing they did wasn't a tracking mechanism, it was just a sponsorship deal.
Perfect is the enemy of good and all that jazz. It's basically impossible to try to be a good actor/explain a good thing without HNers throwing whataboutisms at you.
Of course maybe Brave is actually a bad actor, but none of the things people are calling them out for are meaningful evidence of that. The thing they did wasn't a tracking mechanism, it was just a sponsorship deal.
That would be because no one has any hope left for Google. There's no point in complaining or using their browser, they simply cannot be trusted.
Now an incumbent, that gives hope and disappointment.
Now an incumbent, that gives hope and disappointment.
TLDR: if you typed in binance.us, it autocompleted the 'suggested site' Binance US, which included a referral link that netted Brave (or maybe Eich themselves) some sum of money (not sure how much it was then, but right now it's $100 USDT when your referral deposits $50).
The argument is that Brave should be considered referring users if you get to Binance (or other sites) via the Omnibox.. but it's disingenuous when it was suggested by the query "Binance", since the user already had the intention to visit and likely sign up for Binance. It would've been more acceptable if the omnibox only injected the referral code if you clicked 'Binance' when you tried to search "crypto exchange".
https://twitter.com/BrendanEich/status/1269289242905042944
https://twitter.com/BrendanEich/status/1269423583480082432
The argument is that Brave should be considered referring users if you get to Binance (or other sites) via the Omnibox.. but it's disingenuous when it was suggested by the query "Binance", since the user already had the intention to visit and likely sign up for Binance. It would've been more acceptable if the omnibox only injected the referral code if you clicked 'Binance' when you tried to search "crypto exchange".
https://twitter.com/BrendanEich/status/1269289242905042944
https://twitter.com/BrendanEich/status/1269423583480082432
This doesn't address any of my questions.
Because these are astroturfed responses attacking Brave. You see it on here anytime the browser is mentioned. Meanwhile, it's the best browser available by a mile which explains their attacks.
Got an impartial source for "best"?
https://privacytests.org/ is created by a Brave employee, so that doesn't count
https://privacytests.org/ is created by a Brave employee, so that doesn't count
You're asking someone for a source for their opinion, instead of understanding what an opinion is?
"which explains their attacks" implies "they only attack brave because they know it's objectively better than other browsers".
people are paying hacker news commenters to post this stuff?
I don’t know about “astroturf” and I don’t use Brave or follow it particularly, but the qualms with Brave’s insertion of referral codes and the negative comments around their apology all seem to miss the mark or seem vendetta-ish / politicized.
For example; complaining about privacy, (which was entirely unaffected) or complaining that they couldn’t have possibly done it by mistake (which is not what they said happened).
When I see repeated comments saying wrong things emphatically, it certainly sets off a bit of a radar.
For example; complaining about privacy, (which was entirely unaffected) or complaining that they couldn’t have possibly done it by mistake (which is not what they said happened).
When I see repeated comments saying wrong things emphatically, it certainly sets off a bit of a radar.
I think he is saying it’s group think as in “who taught you to think that?” As in, it’s a popular opinion not necessarily carried with the intention of deceit or financial gain of the individual but never the less a coaches or programmed response. Like fanboys.
Probably more like a PR firm or social monitoring/management company is being paid a princely fee to monitor for things like this and then forum slide, distract, change topic etc.
Source: I work in the same office as one of these companies. They don't work for Google but for another big, well known social platform.
Source: I work in the same office as one of these companies. They don't work for Google but for another big, well known social platform.
Stop using dishonest language: "links" mean hyperlinks in pages, and we never added any affiliate code to those.
https://news.ycombinator.com/item?id=31088549
This is a good feature. Arc has a slightly better implementation of this. Cmd+shift+C is the copy current tab URL shortcut, and it removes trackers by default and lets you know it's "a clean URL without trackers :)" in the flash notification. I'd like to see Brave similarly make the default copy clean and add a copy with trackers second option.
A browser with a waiting list.. now I've seen it all!
Not just a waiting list. You cannot use this browser without signing up for an account.
It's also your s p a c e to breathe on the internet... Whatever that means.
To be fair I’m using Arc and it’s the best browser UX I’ve ever experienced, although it’s still Chromium.
I don't doubt that. I just think their marketing is actively trying to avoid getting new users.
Hide my Email? TBF, for people who are high-sprawl but organized, the UI is next-level as it supercedes multiple windows/bookmarks as org tools and offers a number of affordances that minimize the 'manual resource management', if you will, of legacy browser UIs.
It's rather too bad that their website doesn't actually mention any of the benefits of their browser. Particularly when you can't even give it a go.
Really??
That's a showstopper right there.
That's a showstopper right there.
For the lazy, clicking [Try it for yourself] asks for your email to notify you when "your spot is ready and waiting!".
https://arc.net/
Must be a responsibly release, don't want too many powerusers flooding the web at once.
https://arc.net/
Must be a responsibly release, don't want too many powerusers flooding the web at once.
All I learned from that mess of a site is that Arc is a browser of some kind.
IIRC this is Mac only. Although it is developed on top of Chromium.
I guess Power Users only use Mac.
I guess Power Users only use Mac.
> I guess Power Users only use Mac.
Little Snitch and Audio Hijack/Loopback and Sketchapp and iA Writer and Inklet certainly think so. There are no Windows/cross-platform analogues for any of these. No firewall that suspends connections for an interactive prompt, no way to create virtual audio devices or route audio in Windows, no equivalent to Sketch (Figma comes close I guess) and the Windows version of iA Writer is pretty pathetic. And Inklet simply doesn't have a Windows equivalent even when I have an official Apple Magic Trackpad connected to my computer.
There's just a lot of cool stuff that isn't available for other OSes.
Little Snitch and Audio Hijack/Loopback and Sketchapp and iA Writer and Inklet certainly think so. There are no Windows/cross-platform analogues for any of these. No firewall that suspends connections for an interactive prompt, no way to create virtual audio devices or route audio in Windows, no equivalent to Sketch (Figma comes close I guess) and the Windows version of iA Writer is pretty pathetic. And Inklet simply doesn't have a Windows equivalent even when I have an official Apple Magic Trackpad connected to my computer.
There's just a lot of cool stuff that isn't available for other OSes.
There is absolutely a form of hipster-ism about publishing Mac only software. The truth is, it started because Mac users are more likely to pay for apps and app subscriptions.
So the ironic part is that it's not as much about aesthetic or infrastructure or even ease of development as it is about economics.
So the ironic part is that it's not as much about aesthetic or infrastructure or even ease of development as it is about economics.
In fairness, some of those are rather tied to the operating system, to the point where you're really asking for them to develop an entire new application that happens to do the same thing on a different platform. platform. I mean, yes, it should exist, but I think it's perfectly reasonable for a firewall to be tied to a specific operating system.
Pure user application software is less reasonable, though.
Pure user application software is less reasonable, though.
> I think it's perfectly reasonable for a firewall to be tied to a specific operating system.
Oh, I have no qualms about Little Snitch specifically being tied to macOS. I just find it annoying that this general concept of "a firewall that asks you before blocking a connection" has apparently never been implemented outside of macOS.
I don't want the network request to fail and the application to panic just because I had to be given a prompt with an "allow" button. Suspend the connection instead please.
Windows and Linux firewalls are not yet capable of this, as far as I can tell. If there is one that can, I'd love to replace Windows Firewall with it.
Oh, I have no qualms about Little Snitch specifically being tied to macOS. I just find it annoying that this general concept of "a firewall that asks you before blocking a connection" has apparently never been implemented outside of macOS.
I don't want the network request to fail and the application to panic just because I had to be given a prompt with an "allow" button. Suspend the connection instead please.
Windows and Linux firewalls are not yet capable of this, as far as I can tell. If there is one that can, I'd love to replace Windows Firewall with it.
Portmaster is an application firewall similar to Little Snitch that works on Windows and Linux. When prompting, it suspends connections for a short amount of time, which, as far as I remember when implementing it, is configurable. I can check to tell you the details, if interested.
See https://safing.io/
See https://safing.io/
I am so scared of Portmaster's website. Looking at their pricing page, it's talking about some VPN thing, and they absolutely insist that Portmaster itself is free and open source, but they keep emphasizing "free" to such an extent that I can't tell if they're lying. Free free free, free download, free and open source, etc etc.
Could you confirm if Portmaster is actually completely free forever and doesn't lock any crucial features behind a paywall or different "plans" or pricing tiers? Is it actually just a local firewall? Because if so I might switch to it from WFC, it does look like it might actually do the trick. It has great documentation and seems to have a userbase too.
Edit 30 minutes later: I've been reading more about Portmaster and found this article: https://safing.io/blog/2022/08/17/portmaster-vs-glasswire/
"Many of the features mentioned by GlassWire, such as remote connection monitoring, Wi-Fi network monitor, Virus total scanning, and longer connection history, will cost you $39, $69, or $99 depending on your needs.
Portmaster, on the other hand, is both free in terms of freedom and free in terms of price. Safing makes money by charging a monthly fee for additional privacy features."
They will list every paid feature of Glasswire but only say "additional privacy features" for Portmaster? I am so sketched out right now. Are they trying to hide something or not?
Also, the docs don't mention connection prompts—how did you get them?
Could you confirm if Portmaster is actually completely free forever and doesn't lock any crucial features behind a paywall or different "plans" or pricing tiers? Is it actually just a local firewall? Because if so I might switch to it from WFC, it does look like it might actually do the trick. It has great documentation and seems to have a userbase too.
Edit 30 minutes later: I've been reading more about Portmaster and found this article: https://safing.io/blog/2022/08/17/portmaster-vs-glasswire/
"Many of the features mentioned by GlassWire, such as remote connection monitoring, Wi-Fi network monitor, Virus total scanning, and longer connection history, will cost you $39, $69, or $99 depending on your needs.
Portmaster, on the other hand, is both free in terms of freedom and free in terms of price. Safing makes money by charging a monthly fee for additional privacy features."
They will list every paid feature of Glasswire but only say "additional privacy features" for Portmaster? I am so sketched out right now. Are they trying to hide something or not?
Also, the docs don't mention connection prompts—how did you get them?
CTO of Safing here.
I am sorry this has caused confusion.
In principle it is very simple: The Portmaster software itself is completely free and there is no catch. The only thing we charge for is access to our VPN-alternative, the SPN. This is our business model in two sentences.
So, all local features are free. We are thinking about testing new features with the supporter subscribers in the future, but eventually these features will also become free. However, we will never put previously free features behind a paywall. (The software is open-source, so people will just grab the forks!)
> Is Portmaster actually completely free forever?
Except for the SPN, yes. (additional privacy features == SPN)
> Is it actually just a local firewall?
Not counting SPN, yes.
> Also, the docs don't mention connection prompts—how did you get them?
Set the Default Network Action to "Prompt": https://docs.safing.io/portmaster/settings#filter/defaultAct...
I am sorry this has caused confusion.
In principle it is very simple: The Portmaster software itself is completely free and there is no catch. The only thing we charge for is access to our VPN-alternative, the SPN. This is our business model in two sentences.
So, all local features are free. We are thinking about testing new features with the supporter subscribers in the future, but eventually these features will also become free. However, we will never put previously free features behind a paywall. (The software is open-source, so people will just grab the forks!)
> Is Portmaster actually completely free forever?
Except for the SPN, yes. (additional privacy features == SPN)
> Is it actually just a local firewall?
Not counting SPN, yes.
> Also, the docs don't mention connection prompts—how did you get them?
Set the Default Network Action to "Prompt": https://docs.safing.io/portmaster/settings#filter/defaultAct...
Okay, so I've actually installed Portmaster and things seem to be going well! It actually does seem to suspend connections like you described, which is infinitely better than WFC just setting block-by-default. That's awesome.
It does have quite a few usability nitpicks, and I don't know if it's appropriate to open GitHub issues over those, but if there's some way I can get them to you other than HN (because this is getting quite off-topic) I'd be glad to send them over.
One of my only non-nitpick gripes so far is the fact that I can't allow a connection to pass once without creating a permanent rule. Well, I can if I get a desktop notification (I can just dismiss the notification), but if the notification doesn't get sent to the desktop for whatever reason I cannot control, it shows up in the Portmaster interface itself which doesn't let me allow a connection once without creating a permanent rule.
Would love to chat with you more about this~
It does have quite a few usability nitpicks, and I don't know if it's appropriate to open GitHub issues over those, but if there's some way I can get them to you other than HN (because this is getting quite off-topic) I'd be glad to send them over.
One of my only non-nitpick gripes so far is the fact that I can't allow a connection to pass once without creating a permanent rule. Well, I can if I get a desktop notification (I can just dismiss the notification), but if the notification doesn't get sent to the desktop for whatever reason I cannot control, it shows up in the Portmaster interface itself which doesn't let me allow a connection once without creating a permanent rule.
Would love to chat with you more about this~
Okay, thank you! I had a suspicion it was the SPN but didn't know if anything else was paid. It's very unclear that SPN is the only thing you have to pay for. :/
The whole thing raises big alarms of "there's a catch, there's a catch, they're doing the stupid thing where they put positive reassurances everywhere but don't actually explicitly tell you that there is no catch". It feels so untrustworthy.
I'll make sure to try it out sometime~
The whole thing raises big alarms of "there's a catch, there's a catch, they're doing the stupid thing where they put positive reassurances everywhere but don't actually explicitly tell you that there is no catch". It feels so untrustworthy.
I'll make sure to try it out sometime~
Oh, that is fair. I assume https://github.com/evilsocket/opensnitch doesn't work for you?
I think if I used Linux either that or Lulu would be what I'd go with, but AFAICT OpenSnitch uses wording that suggests it is actually suspending connections for the prompts instead of outright blocking them. I can't find any info on this in the README so I could be wrong but that could probably work yeah.
SimpleWall?
https://github.com/henrypp/simplewall
> No firewall that suspends connections for an interactive prompt
Almost every third-party firewall for Windows has been able to do this since at least the early 2000s. ZoneAlarm had this functionality in 2001, two years before the initial release of Little Snitch.
> no way to create virtual audio devices or route audio in Windows
This has been possible via third-party software since the mid-2000s (Virtual Audio Cable, VB-Cable, etc.).
The other things have equivalents in Windows, too, like Adobe Illustrator for designs, and trackpad vendor-specific software (e.g. Synaptic, Asus) to use it for handwriting.
Almost every third-party firewall for Windows has been able to do this since at least the early 2000s. ZoneAlarm had this functionality in 2001, two years before the initial release of Little Snitch.
> no way to create virtual audio devices or route audio in Windows
This has been possible via third-party software since the mid-2000s (Virtual Audio Cable, VB-Cable, etc.).
The other things have equivalents in Windows, too, like Adobe Illustrator for designs, and trackpad vendor-specific software (e.g. Synaptic, Asus) to use it for handwriting.
> Almost every third-party firewall for Windows has been able to do this since at least the early 2000s. ZoneAlarm had this functionality in 2001, two years before the initial release of Little Snitch.
ZoneAlarm is a whole antivirus afaik, not just a firewall. If there's something out there that can replicate WFC[0]'s functionality while suspending connections instead of blocking them, I'm all ears, since that's my biggest gripe with how Windows Firewall works (since WFC is only a front-end to it).
> This has been possible via third-party software since the mid-2000s (Virtual Audio Cable, VB-Cable, etc.).
By installing drivers and rebooting your computer and you get a fixed number of them.
On macOS with Loopback and Audio Hijack, you can create any number of virtual audio devices and route audio between them however you want with switches and filters and etc. in real-time.
> The other things have equivalents in Windows, too, like Adobe Illustrator for designs, and trackpad vendor-specific software (e.g. Synaptic, Asus) to use it for handwriting.
Adobe Illustrator is not the same type of software (this is why Adobe created Adobe XD). It's not usable for the reasons I used Sketch.
As for handwriting, Inklet was more advanced than that, it allowed you to scale and move the working area around the screen with gestures, and actually write into other applications instead of a dedicated signature window (which is what this "vendor-specific software" were designed for).
My point isn't that you can find some solution to create a similar result, my point is that the actual pieces of software that are available are quite unique and don't really exist anywhere else.
There's just something attractive about macOS being a true Unix with a huge userbase of people who will pay for good apps.
[0]: https://www.binisoft.org/wfc
ZoneAlarm is a whole antivirus afaik, not just a firewall. If there's something out there that can replicate WFC[0]'s functionality while suspending connections instead of blocking them, I'm all ears, since that's my biggest gripe with how Windows Firewall works (since WFC is only a front-end to it).
> This has been possible via third-party software since the mid-2000s (Virtual Audio Cable, VB-Cable, etc.).
By installing drivers and rebooting your computer and you get a fixed number of them.
On macOS with Loopback and Audio Hijack, you can create any number of virtual audio devices and route audio between them however you want with switches and filters and etc. in real-time.
> The other things have equivalents in Windows, too, like Adobe Illustrator for designs, and trackpad vendor-specific software (e.g. Synaptic, Asus) to use it for handwriting.
Adobe Illustrator is not the same type of software (this is why Adobe created Adobe XD). It's not usable for the reasons I used Sketch.
As for handwriting, Inklet was more advanced than that, it allowed you to scale and move the working area around the screen with gestures, and actually write into other applications instead of a dedicated signature window (which is what this "vendor-specific software" were designed for).
My point isn't that you can find some solution to create a similar result, my point is that the actual pieces of software that are available are quite unique and don't really exist anywhere else.
There's just something attractive about macOS being a true Unix with a huge userbase of people who will pay for good apps.
[0]: https://www.binisoft.org/wfc
Virtual audio cable was the shit and yeah you are correct, it does exactly what the Mac app does (and it was on Windows way before Mac was even a real thing).
Used to use it to stream audio into a ventrillo channel lol
Used to use it to stream audio into a ventrillo channel lol
> it does exactly what the Mac app does
no... it doesn't. sure, there are programs you can install that will add virtual sound devices on Windows, but I can't find any program that will let you manage them dynamically, let alone do half the things that Loopback does.
VAC does actually let you restart the entire driver to change the number of virtual audio devices, if no programs are using any of them.
But another big selling point of Loopback is the ability to capture audio from applications without having to change the output device, which I believe is technically possible on Windows (Discord can do it sometimes) but there isn't a program that exposes it through a virtual input device yet.
Linux does seem good for this audio stuff specifically—there may or may not be pretty Linux GUIs for arbitrary audio mixing/routing—however on Windows there are no good examples of it. or, again, none that I can find. VAC certainly isn't one.
Of course, even on Windows, I use Voicemeeter on a daily basis and I have tried to fool around with VSTHost for real-time filters (like dynamic range compression, which I had used a lot on macOS to watch movies), but there's significant latency and I cba to figure out what the problem is. Voicemeeter is still useful for muting my microphone with a macro key though.
If I wanted to try to make something like Loopback myself I'd probably need to continue my months long search to figure out how to write userspace drivers. Because I still can't figure it out.
I'm not trying to shill Loopback here, I'm just giving it as an example of a Mac-exclusive app that does something that you can't easily get on another OS right now. Maybe it's just cause nobody's put in the time yet, but macOS still seems to have more power-user-esque apps imho.
no... it doesn't. sure, there are programs you can install that will add virtual sound devices on Windows, but I can't find any program that will let you manage them dynamically, let alone do half the things that Loopback does.
VAC does actually let you restart the entire driver to change the number of virtual audio devices, if no programs are using any of them.
But another big selling point of Loopback is the ability to capture audio from applications without having to change the output device, which I believe is technically possible on Windows (Discord can do it sometimes) but there isn't a program that exposes it through a virtual input device yet.
Linux does seem good for this audio stuff specifically—there may or may not be pretty Linux GUIs for arbitrary audio mixing/routing—however on Windows there are no good examples of it. or, again, none that I can find. VAC certainly isn't one.
Of course, even on Windows, I use Voicemeeter on a daily basis and I have tried to fool around with VSTHost for real-time filters (like dynamic range compression, which I had used a lot on macOS to watch movies), but there's significant latency and I cba to figure out what the problem is. Voicemeeter is still useful for muting my microphone with a macro key though.
If I wanted to try to make something like Loopback myself I'd probably need to continue my months long search to figure out how to write userspace drivers. Because I still can't figure it out.
I'm not trying to shill Loopback here, I'm just giving it as an example of a Mac-exclusive app that does something that you can't easily get on another OS right now. Maybe it's just cause nobody's put in the time yet, but macOS still seems to have more power-user-esque apps imho.
> No firewall that suspends connections for an interactive prompt
Didn't ZoneAlarm do that on Windows in the 2000s?
Didn't ZoneAlarm do that on Windows in the 2000s?
> Didn't ZoneAlarm do that on Windows in the 2000s?
AFAIK those connections were blocked, not suspended, until you answered the prompt. Does ZoneAlarm still advertise this / is it documented anywhere? I can't find any info on it.
AFAIK those connections were blocked, not suspended, until you answered the prompt. Does ZoneAlarm still advertise this / is it documented anywhere? I can't find any info on it.
> AFAIK those connections were blocked, not suspended, until you answered the prompt
Ah right, very possible.
Ah right, very possible.
there's one I used in the 90s too, like in the XP era, whose name escapes me now.
not sure about sketchapp and inklet, but the first examples are extremely platform specific to the point of requiring a rewrite for different platforms
> the first examples are extremely platform specific to the point of requiring a rewrite for different platforms
Oh, I know. Just cause nobody's done it yet doesn't mean it's not fair to say that macOS is the only operating system that has tools like these already made, though.
Oh, I know. Just cause nobody's done it yet doesn't mean it's not fair to say that macOS is the only operating system that has tools like these already made, though.
iA Writer is available for Windows [0].
[0]: https://ia.net/writer/support/windows
[0]: https://ia.net/writer/support/windows
Except the only thing it has in common with the macOS version is a color scheme. Plus it hasn't been updated in years.
You don't actually get any of the things that made iA Writer for macOS so great, and all the technical issues (such as broken trackpad scrolling) are incredibly distracting, defeating almost the entire point of the app.
You don't actually get any of the things that made iA Writer for macOS so great, and all the technical issues (such as broken trackpad scrolling) are incredibly distracting, defeating almost the entire point of the app.
Finally, the revenge of Windows users for all those years of "sure we support every platform. I mean every Windows platform of course!" (jk of course)
It's not power users per se, but these sorts of apps are essentially fashion and all the people making them are long time Mac heads. The fancy software startup space is really faddish and incestuous.
They’re developing a Windows version right now.
Very cool. When they finally develop a Linux version of their Chromium based browser (already cross-platform) I will consider giving it a shot.
Sarcasm acknowledged. :) It's okay if you don't like the browser I like.
>the Browser Company of New York
lol
lol
Not every query string in a URL is about tracking. This will break some sites.
EDIT: Correction, they are very conservative with which strings are filtered out. See here: https://github.com/brave/brave-core/blob/master/browser/net/...
EDIT: Correction, they are very conservative with which strings are filtered out. See here: https://github.com/brave/brave-core/blob/master/browser/net/...
It doesn’t strip every query string. It acts as if it has a list of known tracking params, but I haven’t investigated the exact mechanism.
I kinda wish it did remove all querystrings. The vast majority of querystrings are nothing more than tracking and marketing garbage, and I can handle the rare situation where one is needed manually. Stripping from a known list of values just means that marketers will start using random identifiers with clever ingestion code, making this mechanism less useful over time.
Stripping all querystrings would break tons of sites, such as this one we're on right now.
It's even worse than using random query strings. Last year, Facebook, Amazon and some other sites started using encrypted URLs that can't be decoded and modified before hitting the server. The good news is that this won't work with just an analytics JS snippet, but the technology will get easier to implement and spread over time. https://www.schneier.com/blog/archives/2022/07/facebook-is-n...
Unfortunately that won't help as it's perfectly possible to add tracking parameters in a static-looking portion of a URL.
Removing all query parameters might encourage that practice, and ultimately even push sites towards creating completely opaque, server-side resolved unique sharing URLs.
Removing all query parameters might encourage that practice, and ultimately even push sites towards creating completely opaque, server-side resolved unique sharing URLs.
Very true. This is a nuclear arms race that I'm afraid users will ultimately lose. The kind of fingerprinting that has been used to determine TOR users is what the end-game ultimately looks like. It's already being done anyway. It's very difficult to avoid, and you will not be able to use 90% of the mainstream internet if you do.
Sort of. Adding an unexpected query variable is generally well handled, which allows Facebook to add fbclid to all outbound links without breaking most sites. Stuffing the tracker into the static part of the URL requires way more integration work.
Klipper (KDE's clipboard tool) lets you set up this sort of thing pretty easily. It can take actions when a certain type of content is copied. So, you can match on "^http[^?]*" and "echo %0" (you can call any program, builtins are provided for MIME types, so you can, for example, launch a browser when you copy a URL) as the action will allow you to replace the copied URL automatically/on-request.
I'll take a second attempt using Ctrl+C over always copying the tracking garbage for 90% of URLs.
Where did you read that it removes the whole query string?
You're right, after looking in their documentation I found that they are very conservative with which strings they filter out.
They only look for specific KNOWN user-level targeting strings to strip. This is actually a very nuanced route for them to take. Other plugins will just filter out everything following a query.
Here is the fine details for those interested: https://github.com/brave/brave-core/blob/master/browser/net/...
As a marketer, they do mention that they retain Campaign level parameters, however the click ID is more than just a user-level identifier. Many times a click ID is the only thing that survives different environments in order to provide any attribution at all.
In fact, a click ID is much more privacy aware and anonymous in every circumstance than a website giving you your own user ID. All good web platforms generate a unique ID for you, which is not anonymized for the web platform. Whereas the click ID is always anonymized for the web platform. When you combine the two, you get a very basic piece of information: this user clicked this ad. Now those websites will still know who you are as a user, and still know which campaign you came from, but not when you specifically clicked. Wow, what a privacy save!
Removing it does very little to reduce what Google knows about you. Google does not need your click ID. The only time it is used is for conversion attribution, and it is completely anonymized between the ad platform and the marketers who run the campaigns.
So this is mostly just sticking it to the little guy, as large data platforms don't need ad-level click IDs to track you. But if you want to make sure that no marketer ever gets credit for driving you to perform an action, then this is for you!
They only look for specific KNOWN user-level targeting strings to strip. This is actually a very nuanced route for them to take. Other plugins will just filter out everything following a query.
Here is the fine details for those interested: https://github.com/brave/brave-core/blob/master/browser/net/...
As a marketer, they do mention that they retain Campaign level parameters, however the click ID is more than just a user-level identifier. Many times a click ID is the only thing that survives different environments in order to provide any attribution at all.
In fact, a click ID is much more privacy aware and anonymous in every circumstance than a website giving you your own user ID. All good web platforms generate a unique ID for you, which is not anonymized for the web platform. Whereas the click ID is always anonymized for the web platform. When you combine the two, you get a very basic piece of information: this user clicked this ad. Now those websites will still know who you are as a user, and still know which campaign you came from, but not when you specifically clicked. Wow, what a privacy save!
Removing it does very little to reduce what Google knows about you. Google does not need your click ID. The only time it is used is for conversion attribution, and it is completely anonymized between the ad platform and the marketers who run the campaigns.
So this is mostly just sticking it to the little guy, as large data platforms don't need ad-level click IDs to track you. But if you want to make sure that no marketer ever gets credit for driving you to perform an action, then this is for you!
> All good web platforms generate a unique ID for you
I disagree. The good websites will not do this.
> But if you want to make sure that no marketer ever gets credit for driving you to perform an action, then this is for you!
Sounds good to me, and doubly so if I want to share the link with someone else.
Although I don't think this mechanism is good enough, actually. I'll just stick with manually editing the URLs.
I disagree. The good websites will not do this.
> But if you want to make sure that no marketer ever gets credit for driving you to perform an action, then this is for you!
Sounds good to me, and doubly so if I want to share the link with someone else.
Although I don't think this mechanism is good enough, actually. I'll just stick with manually editing the URLs.
Make sure you are always using TOR and a VPN. It's also best if you operate off of a linux live-cd environment and boot up a fresh one every day.
You'll also want to make sure you don't own a smart phone, or keep your money in a bank.
Probably best to have your house owned by an LLC shell corp. Also register your cars under that corp as well. Unfortunately, you still have to have a license, voting record, and social security number. But there are creative ways to get around some of that.
For the extra committed, probably good to burn off your finger prints, just for extra security.
You'll also want to make sure you don't own a smart phone, or keep your money in a bank.
Probably best to have your house owned by an LLC shell corp. Also register your cars under that corp as well. Unfortunately, you still have to have a license, voting record, and social security number. But there are creative ways to get around some of that.
For the extra committed, probably good to burn off your finger prints, just for extra security.
I think the assertion that because you can't have total privacy, it's not worth having any privacy is fundamentally illogical.
There's nothing wrong with doing what you can to keep the bad actors away even if you can't keep them all away.
There's nothing wrong with doing what you can to keep the bad actors away even if you can't keep them all away.
I wish I had this for Twitter links in iOS Safari. It's so difficult to scroll to the right and delete all the query parameters. I also wish Apple would give me a way to expand the URL bar to a word-wrapped input that takes up half the screen. I can't stand highlighting text in that tiny little box.
> I wish I had this for Twitter links in iOS Safari.
[self-promotion] My extension StopTheMadness does this: https://apps.apple.com/app/stopthemadness-mobile/id158308293...
[self-promotion] My extension StopTheMadness does this: https://apps.apple.com/app/stopthemadness-mobile/id158308293...
I actually have this installed! But I disabled it for some reason that I can't remember; I think the defaults were too aggressive and I meant to come back and configure it more precisely when I had the time. I still need to do that... thanks for making it!
The other extension I can absolutely recommend is Vinegar, which replaces hostile video players like the one on YouTube (which injects JS to close itself if you attempt to use picture-in-picture) with a native HTML5 video element.
The other extension I can absolutely recommend is Vinegar, which replaces hostile video players like the one on YouTube (which injects JS to close itself if you attempt to use picture-in-picture) with a native HTML5 video element.
> replaces hostile video players like the one on YouTube (which injects JS to close itself if you attempt to use picture-in-picture) with a native HTML5 video element.
StopTheMadness also does this. ;-)
StopTheMadness also does this. ;-)
I’m guessing a side effect will be that SponsorBlock doesn't work anymore with this enabled?
I think it would still work, though I can't say for sure. In any case, it may become superfluous: https://news.ycombinator.com/item?id=35085475
It should be noted that while the effects are similar on YouTube, StopTheMadness and Vinegar operate in significantly different ways.
It should be noted that while the effects are similar on YouTube, StopTheMadness and Vinegar operate in significantly different ways.
FYI/YSK:
When youre on a video with forced ads where you cannot skip through them, go PiP on the video and use the arrow keys to scrub left or right...
I discovered this, then talked to a buddy at netflix, and he said that coding for PiP was a pain because PiP doesnt abide by DRM rules.
What would be cool is the ability to pipe a PiP to VLC and then use VLC to save out a video....
When youre on a video with forced ads where you cannot skip through them, go PiP on the video and use the arrow keys to scrub left or right...
I discovered this, then talked to a buddy at netflix, and he said that coding for PiP was a pain because PiP doesnt abide by DRM rules.
What would be cool is the ability to pipe a PiP to VLC and then use VLC to save out a video....
So you can take a screenshot with PiP without triggering the safeguards?
Report back with your findings.
But if you have any idea how to "pipe a PiP to VLC" let me know...
I'd like to figure out how to "pipe a PiP"
But if you have any idea how to "pipe a PiP to VLC" let me know...
I'd like to figure out how to "pipe a PiP"
Does something like that exist for Reddit? Whatever it is they use on their website is a janky piece crap.
I’ve been using Shortcuts to do this for a while now. Here’s my “Share Clean URL” shortcut:
https://www.icloud.com/shortcuts/b1bcc002fe894f11858721c0b14...
I'm curious how you get this to work:
"Stops URL shorteners. Checks the links you click in Safari for well-known link shorteners — bit.ly, tinyurl.com, t.co (used by Twitter), etc. — and loads the unshortened destination URL instead of the shortened URL. This occurs without setting any cookies or other site data, so you can't be tracked by your click."
How can you determine the destination without revealing any tracking info to the link shortening service? Unless you make the request from your backend, wouldn't the user's IP address be revealed to the shortening service, allowing it (or data brokers) to join it with other data about them?
"Stops URL shorteners. Checks the links you click in Safari for well-known link shorteners — bit.ly, tinyurl.com, t.co (used by Twitter), etc. — and loads the unshortened destination URL instead of the shortened URL. This occurs without setting any cookies or other site data, so you can't be tracked by your click."
How can you determine the destination without revealing any tracking info to the link shortening service? Unless you make the request from your backend, wouldn't the user's IP address be revealed to the shortening service, allowing it (or data brokers) to join it with other data about them?
The IP address is revealed, yes. But there's no other data: no JavaScript, no referer headers, no cookies, URL tracking tags are removed before and after, etc.
I don't have any backend. The extension code is all local on your device and doesn't phone home to me. I don't aim to provide VPN service.
I don't have any backend. The extension code is all local on your device and doesn't phone home to me. I don't aim to provide VPN service.
I can recommend this. Does lots of other useful things too.
Nice. I'm a user and I also recommend it.
Does it work in firefox ios? (Hoping webview makes it work but dont really understand extensions on ios)
No, just Safari.
Love this extension!
> It's so difficult to scroll to the right and delete all the query parameters.
A lot of times, all that's needed is to insert a # character at the right place in the URL, then load that.
A lot of times, all that's needed is to insert a # character at the right place in the URL, then load that.
If you can get to the right place that conveniently, Shift+End Delete works without a page load. But getting their is its own minor inconvenience.
I made a Shortcut to strip links. You can add it to the share sheet. It'll give you a new share sheet with the stripped link. Much faster than mashing backspace.
https://www.icloud.com/shortcuts/528c9af856fc46c9a3d164a85e8...
https://www.icloud.com/shortcuts/528c9af856fc46c9a3d164a85e8...
Safari have it built in for many pages, all that publish a rel-canonical will see Safari share that URL instead – as a way to avoid sharing AMP URL:s I believe
Bad that Twitter isn’t publishing such or is publishing it with tracking
Bad that Twitter isn’t publishing such or is publishing it with tracking
I'm not sure it's even Twitter's fault. Usually it happens when I click an embedded Tweet from a blog post and then copy the URL from the URL bar. It's the blog that adds the tracking data. (Does anyone know why a blog would even care to do that? Does Twitter offer some kind of analytics dashboard where you can segment views of your tweets based on query parameters?)
Twitter adds some crap on automatically whenever you click "Copy link to Tweet"
Also, they do have an analytics dashboard: https://business.twitter.com/en/help/campaign-measurement-an...
Also, they do have an analytics dashboard: https://business.twitter.com/en/help/campaign-measurement-an...
Oh, if you copy from the URL bar then you will always get the exact URL on iOS Safari, but if you copy it from the share sheet you will get the cleaner one
Are there any iOS Safari extensions that do this? Hyperweb comes to mind, though I don't know if they offer this specific feature.
For those looking for similar functionality in Firefox, Chrome, and Edge, I've been using ClearURLs[0] for several years in Firefox and Firefox on Android. It works well.
0: https://github.com/ClearURLs/Addon
0: https://github.com/ClearURLs/Addon
uBlock Origin works well enough for me with some basic lists. Recommended reading for firefox users:
https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don...
https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don...
Is this optional? With ClearURLs, I can choose to copy the clear URL or the original URL. Sometimes we want the original URL in case the ruleset makes a mistake, debugging, or something else.
Just be careful with this kind of plugin. Had something similar installed a few years ago that was breaking some Google links and I had no idea why until I realized I had this kind of plugin installed.
Is there anything similar that would strip URLs from copied images?
When you Copy Image... in Firefox, the URL is also copied to clipboard and then pasted around, see https://www.reddit.com/r/firefox/comments/wil262/any_way_to_... )
When you Copy Image... in Firefox, the URL is also copied to clipboard and then pasted around, see https://www.reddit.com/r/firefox/comments/wil262/any_way_to_... )
Reviews on the Chrome Web Store mention that the extension can break Google OAuth login flow and Amazon checkout. Did you encounter that at all?
Not OP, and YMMV, but i never had problems with google, amazon or any other website. ClearURLs is one of those extensions you install, after you open your browser for the first time and completely forget about it, because it just works (TM). As a matter of fact, I had to make sure that it was even installed, before commenting.
It does break youtrack quite severely and it took me forever to single out this extension. Afaict there's also no way to filter URLs so I had to get rid of it on my work browser :/
I don't use Google OAuth much but it works for when I need to enter YTTV credentials. It has never broken Amazon checkout for me, smells like FUD.
I used to use this and it did indeed break Amazon checkout. Took me forever to figure out!
You beat me to it :)
I use a python script for this and I constantly have to tweak it to understand more urls. It's not just stripping out tracking parameters. There are also redirects to bypass, real urls encoded in the parameters of the tracked url, and all that. There are some formats which I haven't figured out, like many of the ones used in emailed links. I figure that once it converges I'll rewrite it in Javascript as a browser extension, but even after a year or two of usage and tweaking, it still misses a lot and doesn't seem robust.
Give us the gist!
Wow, I'm surprised anyone else wanted this. Ok I might post a pastebin link here sometime. There is some PII in the script that I'd have to edit out first. The script itself is also a mess. It grew without refactoring because I figured on a total rewrite eventually.
No pressure btw, I thought you had something ready to show off!
The most amazing thing about this link is that the cloudflare page it shows me before the actual page actually sends me to the real page instead of just sitting and spinning forever no matter how many captcha or whatever I do.
I suppose Brave went out of there way to tweak the cloudflare options to allow cross browser compatibility. I didn't know this was possible at all. I guess all the other sites on the web just don't care.
I suppose Brave went out of there way to tweak the cloudflare options to allow cross browser compatibility. I didn't know this was possible at all. I guess all the other sites on the web just don't care.
cloudflare is a real worry, huh? Not talked about much but their power is quite a bit larger than a de-centralised web should tolerate.
Lots of mixed opinions on Brave in these comments, very interesting.
I came to use Brave via https://coveryourtracks.eff.org/. Their results on my brave browser instance are very good.
I'll admit I'm imbuing the EFF w/ a lot of confidence here, but a high confidence result from an EFF tool carries weight for me.
I came to use Brave via https://coveryourtracks.eff.org/. Their results on my brave browser instance are very good.
I'll admit I'm imbuing the EFF w/ a lot of confidence here, but a high confidence result from an EFF tool carries weight for me.
I use Brave somewhat reluctantly. In terms of privacy, I would prefer to use Firefox, but I have several issues with Firefox (mostly UI-related) that annoy me too much and that I could never figure out how to correct.
Brave is my compromise browser.
Brave is my compromise browser.
In terms of privacy, I would never use Firefox (over Brave). Brave is much better and secure: https://privacytests.org/
You can lock Firefox down to be tighter than Brave.
Yes you can but that would take a lot of work. Firefox by default is not very private. You can use LibreWolf instead.
Why wouldn't businesses just switch to unique links?
In other words, like switching an amazon link from:
In other words, like switching an amazon link from:
https://www.amazon.com/dp/<product-id>
https://amzn.to/<unique-id>I feel someone did something like this.
Maybe facebook? Probably facebook...
Edit
It was facebook, https://tidbits.com/2022/07/19/facebook-change-ensures-track...
There's a discussion here, https://news.ycombinator.com/item?id=32129100
Maybe facebook? Probably facebook...
Edit
It was facebook, https://tidbits.com/2022/07/19/facebook-change-ensures-track...
There's a discussion here, https://news.ycombinator.com/item?id=32129100
TikTok does this as well; every 'share' is a unique short link that links back to who generated it and is used, in some cases, to suggest people who view said TikTok to both of you as 'people you may know'
By way of idle curiosity: the Amazon example on the CleanURLs homepage and in the repo README calls __mk_de_DE=ÅMÅŽÕÑ a tracking parameter. Is it? Or is it a variation of the _utf8=[U+2603 SNOWMAN] technique to force ancient IE to use a reasonable POST encoding[1]?
[1] https://stackoverflow.com/q/3222013
[1] https://stackoverflow.com/q/3222013
The option "Copy clean link" appears even when both links are identical.
It might be funny (perhaps even educational) to rename "Copy link" to "Copy tainted link" when filth is detected!
It might be funny (perhaps even educational) to rename "Copy link" to "Copy tainted link" when filth is detected!
It's probably better UX to make the options consistent even when there's no difference
Dynamic menus are terrible. Instead of just doing it you have to guess why the item is missing and then select another one.
BRB going to change all my tracking query strings to get around this. don’t be mad at me my OKR is getting tracking to work 2% better.
You should add an extra query param containing a MAC that is required to be present and correct for the URL to load. Just kill the normal idea of web URLs altogether.
I believe the RFCs do not require URLs to have any editable structure to them (beyond host+port+path+query). In particular the path has no particular semantics and the path+query can hold any values that the server accepts. So the server can define a URL to be well formed in any way they want. Editing a URL on the client is a historical accident at best.
Indeed, but my point is more about the assumption that a URL to a public web page is shareable. I don't know that this is every explicitly mentioned in any of the RFSs, but it seems like an undeniable assumption given that the point is for it to be a resource locator. Technically one of these URLs with tracking and a MAC should still be shareable, I suppose, but the tracking would be useless. Webmasters could go even further and generate one-time-use URLs for every page load in every session. They would still technically be URLs, but similarly would be pretty clearly in opposition to the point of URLs.
This is a very nice feature and they should make it the default option. I really hate that when I copy a Google result page I get a reviews url
If I could just import my Firefox logins, brave would be my default browser
If I could just import my Firefox logins, brave would be my default browser
If this becomes common, sites could make link cleaning impossible. They can do this just by commingling the actual content ID the link addresses with the tracking information. Facebook has already started doing this in some places [0].
For example, Facebook posts now have opaque IDs that are unique per-user. This makes it impossible to remove the tracking information and still keep a valid link. For a news site, where they want their content to be indexed by crawlers, it might not be possible to block all non-unique links, though they could certainly make it harder. We'll see what the future holds...
[0] Example of a Facebook post with an opaque per-user unique URL: https://www.facebook.com/pfbid02xQBbtJYKpp8V5j5my5jaWUVij7XC... ( Facebook will know which account shared this URL and there's no way for me to stop them o_O )
For example, Facebook posts now have opaque IDs that are unique per-user. This makes it impossible to remove the tracking information and still keep a valid link. For a news site, where they want their content to be indexed by crawlers, it might not be possible to block all non-unique links, though they could certainly make it harder. We'll see what the future holds...
[0] Example of a Facebook post with an opaque per-user unique URL: https://www.facebook.com/pfbid02xQBbtJYKpp8V5j5my5jaWUVij7XC... ( Facebook will know which account shared this URL and there's no way for me to stop them o_O )
word of caution, any employee at Facebook will also be able to do this and be on hacker and get the same time
I've never tried Brave(no interest in using Chromium), but whenever I see them posted on HN like "look at this new feature in Brave", it's pretty much always something I've had in Firefox natively or through addons since long before Brave even existed. This is certainly no exception.
When I go to their website, they show this asinine comparison of what different browsers support out of the box, conveniently the list only includes things that Brave supports. That strongly suggests cherrypicking to me. I also want to know what a browser doesn't do, and they're conveniently leaving that out. And ok, Firefox does all of those with just a couple extra addons anyway. Comparing to naked Firefox just isn't fair.
This website makes me feel marketed to. That makes me implicitly distrust them.
When I go to their website, they show this asinine comparison of what different browsers support out of the box, conveniently the list only includes things that Brave supports. That strongly suggests cherrypicking to me. I also want to know what a browser doesn't do, and they're conveniently leaving that out. And ok, Firefox does all of those with just a couple extra addons anyway. Comparing to naked Firefox just isn't fair.
This website makes me feel marketed to. That makes me implicitly distrust them.
I've been doing this manually for years. It's nice to see as a feature in my daily driver browser. It's kind of tricky manually when it looks like the GUID at the end of a URL is a tracking link when it's actually the id of the article despite part of the headline being in the URL.
How does Brave determine what is a necessary query parameter and what is not?
Their filters are open source.
https://github.com/brave/brave-core/blob/master/browser/net/...
https://github.com/brave/brave-core/blob/master/browser/net/...
Thanks! Seems unlikely to hit any false positives.
Also trivial to bypass if a developer could care less.
Speculation: they have a list of popular sites & tracking tags
Indeed, a few clicks from the article arrives at the specific list:
https://github.com/brave/brave-core/blob/master/browser/net/...
https://github.com/brave/brave-core/blob/master/browser/net/...
even just manually putting fbclid on the list would go a long way to assuaging the paranoid
I want this feature so much, every time I try to copy a link from Fecebutt or Google and paste it elsewhere. This may be what gets me to switch to Brave.
I built a Mac menu bar app for cleaning your clipboard https://apps.apple.com/us/app/id1528299767 It removes common tracking for the URL in the clipboard
It also works on iPhone via the shared Universal Clipboard
It also works on iPhone via the shared Universal Clipboard
If you get the ClearURLs extension for Chromium or Firefox and follow a link with junk at the end, it will strip it. But I couldn’t get it to clean what goes into the clipboard and indeed this would be the best.
And based on a comment above, it sounds like uBlock origin can also do this, which was news to me!
Been using CleanLinks[0] on Firefox for a while now. Nice to know I have the same feature in Brave now. Sometimes I manually remove query params from URLs when sharing them. I really need to automate that though!
[0] https://addons.mozilla.org/en-US/firefox/addon/clean-links-w...
[0] https://addons.mozilla.org/en-US/firefox/addon/clean-links-w...
Have you tried CleanURLs? It's a recommended extension, and has 120K users compared to the 154 of Cleanlinks.
https://addons.mozilla.org/en-US/firefox/addon/clearurls/
https://addons.mozilla.org/en-US/firefox/addon/clearurls/
Why not make this the default calling it "Copy Link" and offer a second option "Copy Link With Potential Tracking!!!"?
because "Copy Link" tells the user they are about to copy the entirety of the link.
Huh, let's not do that. If I chose "Copy link", I'd expect an exact copy of the string, not a modified (cleaned) one. What next, an image editor where "Copy image" gives you an enhanced image where e.g. people in the background and imperfections on people's skin are removed?
>What next, an image editor where "Copy image" gives you an enhanced image where [...] imperfections on people's skin are removed
Nope, not "next", TikTok did that already
https://www.technologyreview.com/2021/06/10/1026074/tiktok-m...
Nope, not "next", TikTok did that already
https://www.technologyreview.com/2021/06/10/1026074/tiktok-m...
> imperfections on people's skin are removed?
Why stop there? Why not remove the skin altogether :>
Why stop there? Why not remove the skin altogether :>
For Android, I've been using URLCheck[0] for opening any link system wide, to clean the URL and check for redirects and open in specific browser. Just have to set it as your default browser
[0]: https://github.com/TrianguloY/UrlChecker
[0]: https://github.com/TrianguloY/UrlChecker
The article doesn’t mention how the feature actually works and which parts of the URL are removed.
I really like extensions like this.
* ClearURLs – Get this Extension for Firefox (en-US) | https://addons.mozilla.org/en-US/firefox/addon/clearurls/
* ClearURLs - Chrome Web Store | https://chrome.google.com/webstore/detail/clearurls/lckanjgm...
* ClearURLs – Get this Extension for Firefox (en-US) | https://addons.mozilla.org/en-US/firefox/addon/clearurls/
* ClearURLs - Chrome Web Store | https://chrome.google.com/webstore/detail/clearurls/lckanjgm...
I wish I could open a link from Messages this way. You can copy the link, but doing so triggers a "preview", which loads the link in an inset window.
Awesome, I was this close to making an extension for myself to do it, it's so tiring to cut out the refspam every time you copy a link.
I use this sometimes and I love it. I just wish I could configure the browser to make this the default always when I copy a link.
Hmm, I'm not sold on this. There's a very real danger of a new feature, which is hard to explain or understand, chasing away non-technical folks. I feel like this should be an official addon for people who want this kind of thing.
When copying or sharing a link, I usually manually strip out everything after the ? in the URL.
I've been doing this manually for several years now.
Is it possible to create a bookmarklet that does the same thing (i.e., via JavaSript)?
I've been doing this manually for several years now.
Is it possible to create a bookmarklet that does the same thing (i.e., via JavaSript)?
javascript:prompt('URL',window.location.origin+window.location.pathname)
I have an app I use to monitor my clipboard and rewrite certain URLs if sees, placing the clean version back in the clipboard (being sure not to end up in an infinite loop).
I love the idea of reducing extra paramspam on urls... but this is easily defeated with a redirect. I.e. somedomain.com/<uid here>
Isn't this more of a convince when sharing a link than removing the tracking from your own sessions? It kinda assumes that you're already at the final destination when copying so no redirect will be of any use. Or I'm just misunderstanding the purpose.
This is nice, but I wish it would also remove the google tracking wrapper on URLs in g-suite.
We would be nice is to have this also work with a Ctrl + C from the URL bar.
This is great.. Amazing how simple, yeat I've never thought about this
Kinda funny but I just coded up a "clean link" feature in my smart RSS reader that removes all that
Of course when I put that URL filter in, I also added
utm_medium=evil
Of course when I put that URL filter in, I also added
ARCHIVE_TODAY = "https://archive.today/submit/?url="
return ARCHIVE_TODAY + quote_plus(url)
It means showing the middle finger to those that track you
Why is capitalization inconsistent?
Some use sentence case, some title case.
Some use sentence case, some title case.
Does it follow redirects and removes affiliate links?
Nice! Very nice!