Hacker Newsnew | past | comments | ask | show | jobs | submit | gmb2k1's commentslogin

I can't login with my YubiKey (FIDO2/WebAuthn) on the desktop app. It works flawlessly in the browser.


Probably the fTPM of your processor is just disabled in the BIOS/UEFI. You can just enable it in case you really want to upgrade.


Yep, turns out it wasn't enabled in the BIOS. Discovered this myself when I clicked the more info today after getting the 'You don't have TPM on this device' from the Windows PC Health Check. That was really confusing. I definitely thought I didn't even have it on my hardware from its messaging the first time around (and even the second time around I wasn't sure until I went through the instructions and checked all the menus on the BIOS).

So if I got confused and thought I didn't have it on my computer, probably many, many other people less tech savvy than me were similarly confused (or just wouldn't bother. BIOS changes can be weird and scary anyway, Windows couldn't even give good instructions on that part because BIOS menus tend to be pretty different).


Can I save my sessions to an account somehow or do I need to bookmark the links?


the links should be preserved in the sidebar on the left (visible on larger screens and some tablets).


I guess, only as long as I don't delete my cookies. I was thinking of something more persistent that I can easily share between machines.

Amazing product, btw.


Gotcha. Accounts are definitely on our roadmap.


Did I miss something or is this a blog article about how to change a shortcut in the start menu?


So was it really necessary to lay-off the servo and wasm and security teams?


Yes, they need the money to build stuff that will provide them with a steady stream of income from other sources, like online collaborative code editors, a VPN solution, a new diesel powered truck, a Firefox branded amusement park and an adult streaming service.

I love you Mozilla, but please stop. Find a way to make money on what you do best: Firefox.


How? Their three main competitors: Chrome, Edge (if that even counts, being Chromium based), and Safari are completely free AND installed by default on their respective operating system(s). "Not being installed by default" is already a very high hurdle for mainstream acceptance. If you tack on some sort of cost, I can't see that working well for adoption.

Personally, I think they're on the right track with the VPN service. VPN services are already something people are used to paying for, and one of the biggest issues with VPN services are trying to figure out who you can trust out of all the nameless shell companies out there. Mozilla is a trusted brand.


What I don't get about the VPN thing is, that they're just a reseller of mullvad VPN. So, even if I trust Mozilla, that isn't of any help, if I don't trust mullvad.

And if I do trust mullvad, why wouldn't I buy access from them directly? The only reason to get the Mozilla VPN is, to help them to a little commission for ideological reasons.


I don't think the VPN is targeted to people like you or me, who know about them already and know how to research and trust them. It's targeted towards a more "everyday" user, which might not think to go to Mullvad to buy it, or necessarily worry about the privacy implications (personally, I've heard good things about Mullvad and switched over after PIA sold), and just like the ease of integration through buying it with Firefox.


FWIW, I heard good things about mullvad, too. Can't claim, that they didn't pick a reputable provider.


Mozilla famously signs contracts with firms that secure extra privacy protections for their customers. It's what they did with CloudFlare and Comcast.

If I were to use CloudFlare's VPN service of Comcast's DNS, I'd use it through Mozilla because their contracts stipulate extra protections.


And with Google, too: https://news.ycombinator.com/item?id=20807600

"Mozilla has a legal contract with Google that prevents them from using our Google Analytics data for mining or from sharing it with third parties, among other privacy-protecting provisions."


Interesting... so Mozilla is kind of acting like a certification and licensing service for other privacy services


That's one way to look at it. The way I see it is that these partnerships prove that companies don't need to collect and share private data to make a buck.


Mozilla, Google, Microsoft and Apple collectively decide which SSL certificate authorities are trusted. The world would be a much worse place if Mozilla were not part of that process. Which organization would you rather trust to vet the security of every TLS connection your browser makes.


>why wouldn't I buy access from them directly?

Because far more people are familiar with Mozilla than Mullvad. Knowing they're the same service is just insight that can save a few euro.


It's not like they're hiding the fact that they utilize mullvad. The price doesn't differ that much also. Currently, it's even cheaper through Mozilla: 4,99$ < 5,00€.

You're right that they have indeed more brand recognition. Basically, the value proposition is: Out of all the VPN providers, we already did the research for you, to pick one that's trustworthy.


Yes, if the product picks up they can build it in-house anytime they want .

They have only spent effort on a reseller partnership till now, so if it fails to pickup not much Engg effort has been wasted either


I have no idea, but I'm also not head of Mozilla. If they can't make money on Firefox in the future, why even bother to build and maintain it. Then they just become a VPN resell who for some unknown reason keeps building a browser. That doesn't make any sense business wise.

If the management of Mozilla can't find a way to profit from Firefox, other than leaching on the goodwill and branding, then I don't think they're sufficiently competent to full fill their roles.


That's an argument to give up on Firefox and let the community take over, if winning the browser war was the only reason to exist.

If instead the opposite strategy is chosen, the one where Firefox is kept relevant, Servo and WASM would instead be strategically important.

This middle road is a risky one, which can lead to nowhere.


I agree. Use your brand and use Apple-like privacy oriented marketing.

Start with a VPN. Other products could be: password manager; secure storage like Dropbox; and one day even email. Anything which dovetails with the browser and includes privacy issues.

Having a well known browser brand is a huge asset to build upon.


It's right that people are paying for VPNs, but I'm wondering why. Most connections use TLS now, including DNS over HTTP. MITM attacks should not be much of an issue.

What's the use case for regular consumers? Is it about getting around geoblocking or using P2P file sharing without consequences?


>What's the use case for regular consumers? Is it about getting around geoblocking or using P2P file sharing without consequences?

It also makes you harder to track. If your ISP doesn't use CGNAT (ie. you have a dedicated ip), then your IP identifies you on a household level. Combine this with webrtc leaks or device fingerprinting and you can reliably identified at a device level. Compare this to a VPN server, which probably puts you in a pool of a few hundred/thousand people. If you rotate servers, it puts you in a pool of tens or hundreds of thousands of people.


>Is it about getting around geoblocking or using P2P file sharing without consequences?

Yes


Also for privacy in general from the ISP you use. It's nice to decouple your traffic from what is happening in that traffic. Only facebook/amazon/etc need to know where I'm headed on their particular website.


SSL already does that for you.


Most of us prefer the isp not going which IPs are going through so they can't QoS the stuff we like to the lowest. Although I suppose they could they could do the same with any traffic they can't readily identify and just throttle anything that looks like a VPN.


But then it slows down my internet. Why pay for Gig E up/down just to have it throttled?


Here's a VPN idea for Mozilla: bundle your VPN with a PO box / mail forwarding service. Target it to all the FAANG developers who's trying to take advantage of the WFH situation by moving to a lower CoL area, but are hesitant due to their companies' aggressive geographic-based compensation adjustments and enforcement.

/s


Those FAANG developers have to use their employers laptops and VPN.


That's not a problem. For example, you could run the Mozilla VPN on your router, and your work VPN on your laptop.


I know would pay for Firefox if it helped keep them afloat. I doubt I'm alone. But, I also doubt there's enough of us to keep them afloat.


Actually, I would too, if that money is guaranteed to be used only for Firefox development. And only that. Not to pocket, not to an inept C-Suite, not to their political activism. Not to any experiments outside of the core browser.

But that's not even possible. You can only donate to the Mozilla Foundation, which uses the money for whatever they like.


there is always patreon, you could contribute to external developers who contribute to mainline , if they make enough money on patreon they could do it full time.


It won't because people that currently use firefox would definitely switch over to chrome/chrome-based browsers then.


> Find a way to make money on what you do best: Firefox.

They tried. Pocket and cliqz were attempts at that. Tell me if I'm wrong, but I feel like you weren't supportive of those efforts either.


How do you suggest they do that? As far as I can see, to make money from Firefox they need to either charge for the browser, start selling user data, or integrate 3rd party products. The first isn't commercially viable, the second fundamentally clashes with their principles and the third they have tried but gotten a lot of backlash and little success.


I mean, they currently make ~$450 million per year from Firefox due to their search deals (mainly Google but others in other countries). In the past I think they had Bing bidding for the deal as well. No reason for that to not continue if they maintain Firefox marketshare.


Exactly. While it's not ideal to be dependent on a competitor like that it has been a very robust stream on income: https://en.wikipedia.org/wiki/Mozilla_Corporation#Affiliatio... $300M+ for 8 years (and now 3 more years)


Had Mozilla invested 75% of it rather than spending 75% they would have probably had a guaranteed $100 million/year from their investments alone for the next century.


I have no idea how that would work.

Two ideas:

* Let us pay for Firefox development. I'm not sure how much that would bring in.

* Partnerships with news sites. You pay Mozilla, they keep 30% and use the rest to pay the news sites to not paywall Firefox.

Currently Firefox is basically funded by Google, how does that not clash with their principles? It's okay for take money from a company that directly profit from collection user data, just don't collect the data yourself?


Here we see Mozilla's dilemma: half the Internet calling for Mozilla to focus on Firefox, the other half calling for Mozilla to diversity away from Firefox (which is implicitly what people are calling for when they call for Mozilla to diversify revenue).


Well, they already make nearly all their money on Firefox, hundreds of millions of dollars a year worth.


You probably won't like what I'm saying: WASM and Rust are completely irrelevant for the vast majority of people. It's only HN and a couple other places where folks are obsessed with it. Far more important is having a browser that can decipher that laughable piece of shit we're calling the web, and have unleashed upon the world. It would be cool if we could focus on fixing it.


That makes no sense. People might not know about WASM or Rust, but people like fast browsers. Rust is what powers Servo, which in turn made performance of Firefox somewhat acceptable. Gutting both teams is extremely short-sighted.


I wasn't under the impression that Servo was completed or deployed fully in released Firefox. I believe only the CSS engine is?


And WebRender. And there were plans for more…


> You probably won't like what I'm saying: WASM and Rust are completely irrelevant for the vast majority of people

Gears and valves are completely irrelevant to the vast majority of car users.


Well a conspiracy theorist could assert that downsizing their development teams was part of the deal. :)


I'm not saying it was a good move, but they didn't let go all of the security people like that one tweet kinda implied.

https://twitter.com/arroway53c/status/1293867434374569985

https://twitter.com/jvehent/status/1293511397649854464


Were the layoffs a consideration for the new funding deal?


They clearly knew they were in the 11th hour for a big layoff before they would catch even more flack -after- the google deal because everyone would reading the news would also read the part about them still fire employee after a guaranteed 3 years of funding.


Sorry, what?


From my understanding Mozilla VPN is just rebranded mullvad VPN.

So what benefit do you get by purchasing VPN access from Mozilla vs. directly from mullvad? I don´t see any from a security/trust perspective.

Also everyone is writing Mozilla wrong around here. It´s not Mozilla. They changed it to Moz://a. How much did that rebranding cost? Was that money well spent? So many bad decisions.


Other ridiculous examples:

Apple vs. Apfelroute - A bike path through a apple producing region https://www.welt.de/wirtschaft/article192836621/Apple-will-A...

Apple vs. Apfelkind - A small coffeeshop https://www.dw.com/en/german-caf%C3%A9-owner-takes-on-apple-...


It might be an thing for US companies, Apple is certainly not alone.

For instance Wendy's sued a local snackbar here in the Netherlands called "Wendy's". Same here, they somehow expected to win because they're big? [0]

[0]: https://www.volkskrant.nl/economie/zelfs-wendy-s-krijgt-wend... (Archive link: http://archive.is/oiFWv)


> Other ridiculous examples:

Actually I can see the relevance here, especially for that first case.

But as others probably mentioned already, if you don't actively defend your trademark it becomes void and you actually lose it. They don't do it for profit, as this actually costs them money. They rather don't really have any other option than doing that. Well, run the risk of losing the trademark of course. However the case with the pear confuses me, too ...


Trademarks are per industry/category. So going after companies where the similarly is already questionable and further, the industry isn't the same is not needed. The second link is about some coffee shop and the case was lost. Meaning, good example where Apple shouldn't have started the case.

There's also a difference between defending your trademark and going after things were the overlap is vague at best (e.g. the pear thing).


> Trademarks are per industry/category. So going after companies where the similarly is already questionable and further, the industry isn't the same is not needed.

Most of that is a myth, because people keep mixing it up with protected designs, names and the like. Trademarks are another league, though. Otherwise we'd have plenty of real estate businesses called Coca Cola and Apple with equally designed logos for example, and cases like Apple vs some Café would just disappear or not happen at all. Again, they don't do this for fun and giggles. It costs money and is necessary.


There is actually a gamepad-type keyboard as a real product. It doesn't work with gestures but with dedicated buttons. From the looks of it, you can type pretty fast on it, too.

It's called AlphaGrip http://www.alphagrips.com/

Never used one, though.


I've lost all respect for Mozilla by now. They're still vital for the web ecosystem as a whole. But they turned into a polititcal party and I don't like.


Their Android app has no option to logout automatically after a set amount of time. You're logged in indefinitely. I consider that a security risk. Everyone who manages to unlock my phone can completely take over my digital identity.

I contacted their support and made a feature request for auto-logout. Their answer was basically: Just lock your phones screen.

Not good!


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: