I am the author of that add-on ... what would you do in my shoes ?
- provide an XPI (that will only benefit the few since the side-loading process is made awkwarder at every point release) ?
- fight it ? If so, on what grounds and how ?
- something else ?
> - provide an XPI (that will only benefit the few since the side-loading process is made awkwarder at every point release) ?
You could get your add-on signed as an "unlisted"[0] add-on and upload it to GitHub as a "release" (for which you can upload binary files[1]). This would make the add-on less easily discoverable (than it had been), but at least all Firefox users could install it without much of a hassle. OTOH if the add-on becomes popular again, take-down requests might be sent to you or GitHub.
Raly all your users to bug Mozilla about unbreaking side-loading. If addons really isnt supposed be a walled garden as they claim, they should be willing to open a discussion with the community about how to open things up so we can avoid legal bullying like this.
It's not gonna happen. Firefox would be dead by now if it still allowed bad or incompetent actors to make Firefox unusable (as in slow, unstable, and btw insecure), because users wouldn't keep up with that for too long. They'd just use another browser. This may be okay with you for now because you know how to protect yourself against malware, but in the long run Mozilla needs market share to stay relevant and be able to compete with the richest companies on this planet.
Well, it's actually a been big problem for Windows, and installing unsigned software on Windows is harder than it used to be. Also, luckily for Microsoft, installing another OS is harder than using another browser. (I say using, not installing, because there's always another browser already installed on most OSes.)
I'm not sure the "big problem" of Windows stemmed exactly from possibility to install third-party apps, and not from poor security defaults which let those apps to mangle everything around without asking for permission, and poor architectural decisions which let some programs to install themselves (aka viruses). Nowadays Windows is much better with this staff than it's used to be, in spite of the fact that (contrary to your statement) installing unsigned software is still as easy as pushing buttons.
To be fair, Linux and friends aren't much better in that regard. Permission management for locally running programs is pretty much poor by default in all major operating systems. SELinux and AppArmor for Linux improve on the situation, but they're usually not the default unless you're using Fedora, and even there, it might need some extra configuration.
I'm looking forward to capability-based systems with microkernels, since they really improve on the situation, but I think it'll take a while until we get some major ones. Maybe Google's Fuchsia will establish itself soon enough, who knows? (We'll also have to see what can be done about hardware security, since any software mitigation could potentially be rendered useless by insecure hardware.)
> To be fair, Linux and friends aren't much better in that regard.
Linux gets there a different way. The standard way to install applications is from the package manager and essentially all of the applications in there are trustworthy (because they're all open source and if they did anything seriously user-hostile, someone would fork it and that version would be the one in the package manager). Meanwhile the package managers do actually add nearly everything that isn't user-hostile, so the need to install anything from another source, while still possible, is rare enough that most people never have to do it.
And binaries downloaded via web browser don't even have the execute bit set by default. You can still do it, but you have to know how, and the people who know enough to know how to do it generally know enough to be suspicious when doing it.
And even then, things typically run as the user rather than root/administrator, so they can't alter the system or anything other than that one user's (presumably backed up) home directory.
Having even more granular permission would be even better, but restricting the harm to one home directory of one user and only in cases of users who are at the same time knowledgeable and stupid has already handled basically the entire problem.
Package managers are exactly the centralized "app store" model, and there have been plenty of periods where users have had to add third party repositories to get basic functionality (DeCSS, video codecs, ZFS, etc).
The difference is that Linux repositories are less noteworthy to attack, have a more distributed culture not ruled by capitulating lawyers, and can actually jurisdiction shop.
The ultimate problem is a lack of a cross-software security model of the OSs, Linux included. User-based isolation is cool and all, but orthogonal to the modern world [0]. For decades we've been continually looking for better ways of isolating local apps, while also rejecting centralized control. We keep looking, while centralization keeps ratcheting.
I'm still hopeful that a well done capability (handle-based) system would go a long way, but not fully solve it. Unfortunately that means shedding off POSIX/LSB rather than duplicating the entire monolithic OS environment for every security context.
[0] Where say even a local LAN IP address is security-critical information!
> Package managers are exactly the centralized "app store" model, and there have been plenty of periods where users have had to add third party repositories to get basic functionality (DeCSS, video codecs, ZFS, etc).
And they still work precisely because the user can do that.
> For decades we've been continually looking for better ways of isolating local apps, while also rejecting centralized control.
The main issue is that there is so little real benefit in it. It's possible to isolate e.g. LibreOffice so that it can't access anything it shouldn't, but in general the authors can be trusted not to be doing anything nefarious to begin with, so what you're really doing is limiting the damage in the event of compromise. In which case you're still pretty screwed, because it inherently needs access to your documents, so the focus has not surprisingly been on preventing compromise rather than mitigating after the fact.
> We keep looking, while centralization keeps ratcheting.
The motivations behind the rise in centralization are authoritarian and pecuniary rather than any legitimate security concern. Trying to prevent it by finding alternative ways to improve security is like trying to repeal the DMCA anti-circumvention rules by finding alternative ways to reduce piracy. They'll never be satisfied because their motivations aren't the stated ones.
> in general the authors can be trusted not to be doing anything nefarious to begin with
It's a dream. Kept alive by a very diligent community, but let's not kid ourselves that it's a very strong assumption.
> In which case you're still pretty screwed, because it inherently needs access to your documents
Access to the specific document you presently want to edit (say through an OS-provided file select dialog or equivalent cli) is much different than unfettered access to all of your files.
> The motivations behind the rise in centralization are authoritarian and pecuniary rather than any legitimate security concern
People do choose say Apple products precisely because of the curated Disneyland App store. Centralizers certainly have their selfish motives, but people are driven into their arms looking for safety. Browsers are used for software distribution precisely because they're a sandbox - there's much less fear of the unknown than running a random exe.
> Access to the specific document you presently want to edit (say through an OS-provided file select dialog or equivalent cli) is much different than unfettered access to all of your files.
This is one thing I like about Android. You can avoid requesting file permissions for your app by using native intents for file access. I think its the same for other stuff, like email. As much as I loathe Googles control over Android, I think this is a good thing.
And they still work precisely because the user can do that.
And you can install an anti-paywall extension in Firefox.
The moment you concede the Linux "well you can work around it" argument is the moment you have to stop arguing on pure absolute principle and start arguing about practicality and the relative difficulty of workarounds.
So, if hypothetically microsoft were facing more competition and people left due to malware you would support them doing the same move where they only allow microsoft-approved applications unless you replace some flag in the bootloader for example?
And of course the next step would be DMCA takedowns for applications in the appstore. Everyone's computer would effectively be under US jurisdiction.
Their market share is lower because at its peak, Chrome didn't exist.
The rise of Chrome is responsible for all of Mozilla's lost share. But major factors causing Chrome to gain share are being the default on the most popular mobile platform (Android) and being heavily promoted on google.com for many years.
Making it harder to install addons (and breaking all the old ones) is one of the things contributing to Mozilla losing share to Chrome. People used to use Firefox over Chrome because of all the great addons, which they then broke, leaving users with less reason not to use Chrome (which was significantly faster until Firefox Quantum). In other words, the causation is exactly the opposite of what you're suggesting.
The reason I switched to Chrome way back when from Firefox is that they changed the UI and that broke some of the add-ons I used. At that point I thought "well, the browser looks like Chrome now, it has as much customizability as Chrome, but its JS engine is slower, so I might as well be using Chrome." At the time I was playing a browser-based game, where the speed of JS mattered a lot to me.
If all the add-ons had kept working on FF, then I probably wouldn't have switched browsers.
I used to default to Firefox for work. Then they killed the old addons, which broke a major part of my workflow (FireFTP's "open a file and as you edit it it automatically re-uploads" feature). So there was a lot less keeping me stuck to it. Recently, and this is past Quantum, performance on some things (Google Apps) became abysmal (now, this could well be Google being half-assed or deliberately malicious about testing) but that was enough that I gave up on Firefox for work.
I haven't used Chrome in a while, but I was under the impression sideloading was completely blocked in Chrome nowadays. So the fact that Mozilla allows sideloading at all puts them ahead in that regard.
The rise of Chrome is responsible for all of Mozilla's lost share. But major factors causing Chrome to gain share are being the default on the most popular mobile platform (Android) and being heavily promoted on google.com for many years.
Not giving any technical and ux credit to chrome for also being a major factor for firefox's loss of market share is disingenuous IMO.
Indeed. The lack of Chrome-like profiles keeps me off Firefox.
I want to have a profile for my work, and a personal profile. Chrome provides that, and Firefox, last time I checked, required multiple hoops to enable and also blocked me from having more than one open.
I would even contribute funding to that if Firefox had a "Fund this feature".
I'm looking at the "containers", but it isn't very self explanatory. So with this, I couldn't have two installs of Bitwarden, one for personal and one for work?
I can't offer you a number, but it's significant enough for Google to offer me to autocomplete "firefox quantum addons" with "stopped working", and relevant discussions left a visible footprint on the net. I'm not sure how is the second sentence related to the question. If you're implying that addons dragged it down -
it for sure is incorrect.
Yes, Quantum changed API => it made a bunch of addons dead => lots if worried, and upset users appeared discussing it. I have nothing against Quantum, I accept it was necessary to go for a new model, but it clearly shows addons are important for a significant share of users.
You said "exactly because of choice of third-party addons" and that's what I'm questioning. I'm not questioning whether addons in general are important for a significant share of users.
Could you clarify your position please: do you think that "Significant part of FF's userbase decided in its favor exactly because of choice of third-party addons" is incorrect?
What you want to have is a trustworthy place where >99% of users can get >99% of software. You can have that -- look at Linux package managers -- without preventing side loading. And in fact that's necessary to prevent despotism.
The people operating the repository want people to use it. They don't want them getting things from untrustworthy places. But if they can just prohibit that, they can be tyrants -- refusing beneficial software that the user wants because the monopoly provider has a conflict of interest or is being coerced by someone else.
By contrast, if the user can load the beneficial application themselves then the repository has the incentive to prevent that from happening (and thereby discourage users from doing that in general) by carrying it themselves. And the fact that there can be competing repositories means that the one that carries the most beneficial software and the least user-hostile software can be the one that wins in the marketplace. But not if the vendor locks everyone else out and becomes an abusive monopolist.
I think Linux is quite a bit different. Firefox shares its space with applications that have the same privilege, making sideloading into Firefox much easier, especially on Windows. And then Linux is also niche enough as a consumer OS that it's just not as attractive for malware in the first place.
> I think Linux is quite a bit different. Firefox shares its space with applications that have the same privilege, making sideloading into Firefox much easier, especially on Windows.
All the more reason to have a supported way to do it. If they require the malware to replace the Firefox binary with a different one, what happens when it does? The user ends up with twelve pieces of malware instead of one because the original malware author didn't bother to support browser updates properly and the user ends up with a browser full of publicly known security vulnerabilities.
> And then Linux is also niche enough as a consumer OS that it's just not as attractive for malware in the first place.
People have been claiming that as the reason there was so much more malware on Windows for decades. Then Windows adopted some of the same types of measures as Linux and the amount of Windows malware fell off considerably.
It's still falling even after the Quantum push. It's dipped under 5% total market share and under 9% on desktop. Losing a percentage point every several months.
You are deeply misinformed, and to be blunt, people like you are killing Firefox. Somehow Firefox managed to go for over a decade without blocking sideloading of extensions.
And no Mozilla should not be thinking in terms of "market share". There is no market! Mozilla is a non-profit. They should not be sharing the same paradigm as Google. And it is this vanity-driven pursuit of "brand prestige" and "market share" that has ruined things.
It makes business sense for Google's platform for them to do things the way they do. It makes absolutely no sense for Mozilla to emulate Google. The very fact that Mozilla can just afford to make unique software without the constraints of the market, supported by donors, is a strength, not a weakness. They should be leveraging it instead of trying to "stay relevant" and compete with Google on Google's terms.
And this whole incident is a disgrace. If it wasn't for Mozilla getting between users and their software, then this takedown would be nearly irrelevant, as it would be that much easier for users to install it. It would probably even disincentivize take-downs like this, because they would be so futile.
No? First of all, I'm saying that allowing sideloading is actually hostile to the majority of users, and I'm also saying this threatened the very survival of Mozilla, so this needs to be part of the consideration.
I'm sorry to be rude, but I honestly believe that the only thing that will save Mozilla is for people like you to take your terrible ideas elsewhere.
You must see that your ideas are not working. Have you been able to attract new users, or even prevent existing users from leaving? No? So then how can you be so convinced that you are right?
Firefox is software, not an experience. Winning over people that don't care is not an accomplishment, even if you could do it. Trying to be better than Google at nannying your lower functioning users from hurting themselves is futile, and punishes everyone else.
You're feverishly stripping away everything that made Firefox superior. Driving away developers who have made unique extensions that cannot be replicated elsewhere.
And for what? What is your end game? Have you seen the Chrome store? It's awful! The majority of extensions are very low quality and often misleading. And they are unresponsive and have to employ strange hacks to do things that Firefox extensions did very simply (like taking a screenshot, or interacting with other extensions).
And what is your ideal outcome? To have Firefox be considered a good browser by Google's standards? How about what the users standards?
You are trying to slowly turn emacs into an cheaper Microsoft Word. And patting yourself on the backs for doing it.
> We have telemetry data on performance, user retention, installed addons and how these things correlate.
Then why is that not itself an obvious solution? Use that data to provide a default-on blacklist of known-malicious addons. Then you have a blacklist rather than a whitelist, so it can justifiably be more difficult for the user to override it and the user has no motivation to do so for a malicious addon they didn't intentionally install to begin with.
It also gives you the opportunity to allow the user to specify a blacklist provider, so that if the original vendor ever gets compromised because they're forced to operate in an oppressive jurisdiction, they can farm out the low-resource task of hosting the blacklist to someone who isn't compromised, and the user (or the distribution packaging the browser) can make that determination for themselves.
As I recall, because people were already programmatically generating endless numbers of malware extension IDs to avoid blacklisting.
Blacklisting depends on a limited supply of whatever you're trying to control. UUIDs are not limited.
More generally, if you come up with an obviously superior solution to a problem that someone else has claimed is important and difficult, and has spent considerable resources addressing, perhaps it would be more constructive to investigate or ask questions to test your understanding of the situation before assuming and asserting that the other people are doing it all wrong?
I'm not saying mozilla has the best possible solution here. I don't know what that would be. I do know (I work for mozilla though not in this area) that the step was taken to address real, and very active, threats to security, privacy, and stability.
> As I recall, because people were already programmatically generating endless numbers of malware extension IDs to avoid blacklisting.
Which is a good reason not to use the extension ID as the sole method to enforce the blacklist, and is why anti-malware software generally uses a signature-based approach.
> More generally, if you come up with an obviously superior solution to a problem that someone else has claimed is important and difficult, and has spent considerable resources addressing, perhaps it would be more constructive to investigate or ask questions to test your understanding of the situation before assuming and asserting that the other people are doing it all wrong?
You're implying this is a novel problem that hasn't been widely studied by everyone and that they're not actually doing it all wrong.
> I do know (I work for mozilla though not in this area) that the step was taken to address real, and very active, threats to security, privacy, and stability.
There are many ways to solve a problem by trading it for a set of different problems. Centralized authoritarian control is exactly that. And those things can be popular in the same way anything that externalizes costs and internalizes benefits can be -- because that type of thing seems attractive to the people not directly paying the cost of it. Until the victims (in this case the developers and users whose apps you prohibit) devise a way to protect themselves. Then you end up in an antagonistic relationship with your users and addon developers. What's the cost of that?
Meanwhile there are other solutions that don't do that.
Dredging telemetry data has a nasty effect of letting you find precisely what you are looking for. There is no way to prove from passive monitoring of telemetry that rouge addons were causing people to abandon Firefox, nor that this measure stops people from abandoning Firefox (Or even stops rouge addons, after all its trivial to recompile firefox and replace a binary, if this becomes a problem is firefox going closed source next, for the users of course). But if you can show two numbers that seem to have a correlation (Like Pirates and Global Warming), you can advance any agenda you care to.
Not to mention this "telemetry" process is entirely opaque, and used to justify decisions like this in a very Ex Cathedra sorta way, where you either accept the conclusions they have made from data you can't see, or be treated like your opinion is irrelevant.
Its a very hostile way to run a supposedly "Open Source" project.
"It's not gonna happen. Firefox would be dead by now if it still allowed users to customize their webbrowser and make Firefox unusable (as in slow, unstable, and btw insecure), because users wouldn't keep up with that for too long. They'd just use another browser. This may be okay with you for now because you know how to protect yourself against misconfiguration, but in the long run Mozilla needs market share to stay relevant and be able to compete with the richest companies on this planet."
Substitute in any positive feature that puts the user in control of their web browsing experience, power over something means the power to break it too, using that as a reason to remove functionality is stupid.
Doubly so when you pile on the "omg if they do this mozilla is doomed" hysterics.
Sure, you can always claim that some random lockdown is vital. The thing is, not every assertion is the same. Yours could be nonsense while mine could still be true.
If you claim something like "John is a carpenter because John is a human and carpenters are humans" and someone points out that your logic doesn't follow (by applying it to some other known non-carpenter human), you can then claim that this doens't prove that John isn't a carpenter, but the point is that the original claim utterly fails to prove that he is.
Where did I assert something similar to your example? It seems like a false analogy. The criticism wasn't even that my logic was flawed but that the same argument could somehow be made to justify any user-hostile action.
If the problem in your point of view is that I didn't /prove/ how big of a problem sideloading was then yes, I didn't even attempt to do that. There's a separate subthread on that question.
> Where did I assert something similar to your example? It seems like a false analogy. The criticism wasn't even that my logic was flawed but that the same argument could somehow be made to justify any user-hostile action.
That's why your logic is flawed. If a construct can be used to "prove" various known-false statements then it has no value in proving anything.
> If the problem in your point of view is that I didn't /prove/ how big of a problem sideloading was then yes, I didn't even attempt to do that. There's a separate subthread on that question.
There is no proof of it there either. The most popular platforms (Android on mobile and Windows on desktop) allow the user to load their own applications, showing not only that it can't be a major cause of failure in the market but that it seems to be a characteristic of the player with the most share.
> Yes, if... But it can't. That criticism of my statement didn't make sense.
It applies directly. Anything that gives the user a choice can make the user experience worse for a user who makes the wrong one. But it also makes it better for a user who makes the right one in a way different from what the developer would have had to use as a default -- because sometimes something is right for 70% of the users, so it should be the default, but the other 30% are better off with something else. Taking away the choice makes the 30% worse off to benefit the 10% of the 70% that would have chosen incorrectly for themselves. That is not a relative advantage.
I'll reply there, but note that you haven't addressed my point -- other platforms survive and indeed have the largest share without prohibiting users from installing software, even when competing directly against others that do.
Nobody is "prohibited" from doing so. You want a Firefox that lets you do whatever you want, you can easily use an unbranded or pre-release build, or even roll your own or use someone else's lightly-tweaked fork. Nobody owes you an officially supported product that's for a wide audience and is also a complete free for all. Even Ubuntu and other Linux distros require you to opt into third-party software channels. You just don't like the specific choice that Mozilla is giving you, but it's still very easily there.
I think users should direct their attention towards Mozilla. They're the ones who decided that it is appropriate to take the extension down, and they're in the best position to fight it (compared to individual extension developers). There's a chance that this decision was done by a low-level reviewer and does not represent the official stance of Mozilla.
Also, anything that gets (or forces) the actors behind this to issue a takedown request against GitHub is good, because then there's a chance GitHub will tell them to pound sand (sending a strong signal to others that unconditional compliance with such demands may not be the only, or best, course of action) or actively fight it.
As I mentioned in a previous discussion on this [0], I would investigate removal of those websites from google by quoting google's terms of service:
"Cloaking refers to the practice of presenting different content or URLs to human users and search engines. Cloaking is considered a violation of Google’s Webmaster Guidelines because it provides our users with different results than they expected.
Some examples of cloaking include:
...
Inserting text or keywords into a page only when the User-agent requesting the page is a search engine, not a human visitor." [1]
That you're able to provide the same view shown to google isn't exactly 'bypassing' anything.
Rename the plugin and change the description. The message from Mozilla states that the problem is the intent of the plugin. The technological measures it actually takes are not illegal per sé, but are illegal when used to circumvent paywalls (of course IANAL).
If you present this as a plug-in that allows you to view websites as the Google bot views them, for educational and debugging purposes, there is no problem. You can give the fact that it won’t see the paywall as an example. It’s actually useful for that purpose: you are not lying. It’s just that most people will install the plugin for its ‘side effects’. Their use of it will still be illegal, but the intent will not be illegal. Cf. Firearms, crypto, drugs, ...
(I say this as someone that pays for various journalistic sources and I encourage everyone to pay for at least their three favorite sources)
The intent of the plugin should not be illegal - that is what this battle is ultimately about, and this takedown action is essentially baseless bullying via the legal system. Each party to a transaction has their own desires, and what these companies are ultimately trying to do make you conform to their internal business desires post facto.
In any transaction there is a demarcation point where interests meet and then part. Businesses have gotten used to this idea of decommodifying [0] their products rather than competing - spamming restrictive clickwrap "licenses" etc. So much so that we view common sense rights like "first sale doctrine" as a friendly exception rather than the bedrock norm. A website telling you how you must/mustn't display the page you've retrieved is equivalent to a retail store demanding a share of your business's profits if you use their products commercially. We can envision such a scheme being cooked up with "terms of sale" and blah blah, but people would rightfully not stand for it - markets and society simply cannot function with such top-down control.
The only difference here is that civilization needs to re-figure these things out for the digital world, especially as frivolous overenforcement appears to be much easier.
[0] Adding unnecessary complexity/restrictions to make their market less efficient. See also: net neutrality.
You know, I consider myself fairly liberal on technical issues, and I agree with you in the general sense, but I don't agree in this specific instance.
This isn't a situation like Aaron Swartz, where the companies in question are restricting access to publicly-funded research. The newspapers are privately-funded entities that conduct their own investigative journalism.
This isn't a situation like Weev, where there was no access control to the data and he was just probing exposed endpoints.
This isn't a "right of first sale" issue. It could be if the publishers were trying to restrict access to page content after you paid for an account, but that's not what's happening here.
I agree with the GP that the issue is the framing. It's the difference between selling a mask, and selling a mask that's advertised to let you rob a bank without being caught.
My argument isn't based on liberating content, but that it's simply not one's responsibility to implement someone else's business rules.
The problem is that the publishers are still supplying their content for free, while then trying to attach arbitrary post-facto terms. It would be straightforward to just not send the article to someone they don't want to view it, but yet this is not what they have chosen to do.
The terms aren't post-facto, they're a priori. You can access the content if you paid for an account or if you're Googlebot. Impersonating Googlebot doesn't change the terms of the access.
Note the description from the add-on page "This extension will mangle your browser's requests to maximize the chances of bypassing paywalls". This is where there's a meaningful difference from the Weev situation.
You can also choose to not read the content if you don't feel it's worth the money.
> Impersonating Googlebot doesn't change the terms of the access.
But I wouldn't be "impersonating" the Google bot, I would just be using it's user-agent string. That does not make me the Google bot. If a foolish publisher chooses to interpret my usage of that string as me being Google, that is not my responsibility.
Just like with the Weev situation, this is another case of someone trying to shift blame for their crummy security.
A user-agent string is NOT authentication. It is merely supposed to provide a hint to the webserver.
I once saw a website that didn't have ads and let you view their content for free if the width was less than 700px. I guess they figured they were driving away more mobile users or something that it was worth. So, was I being criminally minded when I resized my browser to view their content instead of jumping through their hoops and giving them my email address? At a certain point, it is not my responsibility to hold their hand and play along with their pretend restrictions.
The protocol is the transaction demarcation point - anything else is sophistry. Let's try out an analogous argument with physical goods:
Customer goes to Home Depot, buys a bunch of $5 aviators. Sells them on Amazon for $50. The distributor sues the customer-reseller for violating their contract to not commercially resell, which undermines their expensive offerings. Customer points out they never entered into any such contract at Home Depot. The distributor claims Home Depot is a mechanical conduit that only facilitates a larger relationship, and the transaction actually took place between the customer and distributor, with the "standard" terms having been available on request.
The fundamental truth is that the interests of any buyer and seller are only aligned at the exact time of sale - afterwards they diverge. What has happened is that pervasive information technology has got sellers attempting to retain some kind of interest in things after they've sold them, with the "transaction" never really ending (an oxymoron). Copyright is one of the hooks by which they're purporting to do this (which actually at the very least it needs to be reformed so a seller of "digital goods" cannot destroy your access to a copy you've paid for)
As I said before, society cannot function this way - non-pure ownership can work for big tickets (eg real estate), but centralization and every item having a history simply doesn't scale. And as I also said, there is a very simple remedy for publishers - stop sending the article to people they do not want to view it!
(Your argument also implies that it is illegal to suggest someone visit a URL with lynx to avoid a javascript popup)
Alice goes to Home Depot. Aviators cost $50, but they're on sale for $5 if your name is Bob. Alice tells the cashier that her name is Bob and shows an (obviously) fake ID. The cashier isn't paid enough to care, so Alice gets the glasses for $5.
I agree with you that anything Alice does after this point is her own business. I could accept an argument that Home Depot should've paid the cashier more to help prevent the issue. But I don't think that makes Alice's actions at the point of sale less fraudulent.
> And as I also said, there is a very simple remedy for publishers - stop sending the article to people they do not want to view it!
Which the publishers do. They don't send the article unless they think you're Googlebot.
> Your argument also implies that it is illegal to suggest someone visit a URL with lynx to avoid a javascript popup
My issue is with intentionally changing the user agent header to impersonate a well-known crawler that has been given access to the site under specific terms.
I don't have an issue with using other browsers or javascript blockers or ad blockers. There's a difference between spoofing a client-> server request and blocking a client -> server request.
> Which the publishers do. They don't send the article unless they think you're Googlebot.
I've never had trouble viewing an article in incognito mode, or sometimes even hitting stopping a load before javascript runs, so I've been under the impression that it's mainly javascript trickery. My argument here was with that assumption, so perhaps it's moot.
> Alice tells the cashier that her name is Bob and shows an (obviously) fake ID. The cashier isn't paid enough to care
I'd say that the proper example is that the cashier doesn't check ID and isn't even expected to by corporate. Companies aren't even strictly against this type of soft-fraud word-of-mouth trick, as it just further helps their price discrimination and customer mindshare. Whether you get one free birthday desert per year or five, you're still buying meals.
The elephant in the room is that Google could easily setup a system whereby Googlebot got secure access to the articles. I think they haven't done this because of an idea that the same pages should be served to users. So who is defrauding whom?
Philosophically I'd assert that the Internet philosophy is directly opposed to the very concept of fraud - "identity" does not scale, especially across jurisdictions. We've finally got a way to formalize and mechanically execute contracts purely between private parties, so why cling to a heavyweight idea of post-facto enforcement based on nebulous ambient natural-language rules, especially as an overarching foundation? When you put a quarter into a "claw game" and it drops your prize before the chute you don't sue for "fraud" - you just stop putting quarters in.
> I've never had trouble viewing an article in incognito mode, or sometimes even hitting stopping a load before javascript runs, so I've been under the impression that it's mainly javascript trickery. My argument here was with that assumption, so perhaps it's moot.
Typically publishers will use a combination of cookies and javascript to attempt to enforce a soft limit of X articles per month for normal users. Publishers also use UA sniffing to give unrestricted access to Googlebot and other crawlers.
Circumventing the former by blocking cookies or javascript definitely should be legal, because the client should be control of their local computer. Spoofing requests to take advantage of the latter (which is what this specific extension is doing) isn't okay IMO.
> The elephant in the room is that Google could easily setup a system whereby Googlebot got secure access to the articles. I think they haven't done this because of an idea that the same pages should be served to users. So who is defrauding whom?
Something other users have suggested[1] in response to this article. Maybe that will happen in the future, but I think it's a whataboutism with regards to this specific incident.
Google explicitly supports paywalled content[2], so I don't think it's fair to say that publishers are defrauding Google.
I don't find your analogy analogous either. Not only did you equate physical property to IP, but even if you accept that equivalence for the purpose of argument, your analogy seems like it would be better if...
Home Depot gives (more like leases, when taking into account that copyright doesn't allow transitive redistribution... no first sale doctrine for intangible/unfixed IP) the aviators to Bob for free, knowing that Bob will take a bunch, set up a table outside that looks like he's giving away free sunglasses, but when you pick up a pair a Home Depot employee comes out, snatches them away from you, and starts pressuring you to get you to buy a pair.
I'd classify that as a persuasion pattern, which is partly why this is so polarizing (bad pun, sorry...). You had the aviators in your hand, or in Google's case, you read a snippet they had indexed. You can practically taste it, metaphorically speaking, and then comes the hard sell. Either you pay them for the thing because you were so close to getting it and aren't going to let a few dollars stop you, or you get angry because you had the thing you thought you were about to get snatched away from you. The seller is counting on that, by grabbing for the product, you're committed to getting it even if you discover it actually costs money.
Tracking the ownership of the aviators is a non sequitur, as the issue occurs at the point of transaction, not before or after.
> [Bob] set[s] up a table outside that looks like he's giving away free sunglasses, but when you pick up a pair a Home Depot employee comes out, snatches them away from you, and starts pressuring you to get you to buy a pair
> You had the aviators in your hand, or in Google's case, you read a snippet they had indexed. You can practically taste it, metaphorically speaking, and then comes the hard sell
I don't think that just because a publisher makes content free to one user for one use case it obligates them to make content free to all users for all use cases.
Does a studio including snippets of a movie in a trailer mean that the movie has to be distributed for free?
I would argue Google's actions are more akin to an advertising or PR firm drumming up interest by showing bits of the article to consumers.
If I had to condense my thoughts into a couple of bullet points:
1) There is a colorable difference between ad blockers and what this extension is doing
2) I think it is unfair to characterize disapproval of this specific extension as an attack on ad blockers in general
3) Publishers have the right to give samples of their content to search providers without them being obligated to make the content free for everyone
Your retail store analogy is a red herring. A browser plugin that “maximizes the chances of bypassing paywalls” is attempting not to be party to a transaction, because if it succeeds, the user has expressly not agreed to the seller’s terms.
Instead your position appears analogous to arguing that altering a driver’s license to gain free admission to a cinema by misrepresenting oneself as entitled to senior citizen terms of entry is justifiable despite being prohibited by law in that jurisdiction.
It’s clear from this and other posts that you have articulate, principled view on many issues. So why aren’t you addressing the underlying economic issue? Publishers, like any business, need to earn revenue. If technological barriers to accessing intellectual property — and the legal protection thereof — are not valid (your claim of “frivolous overenforcement”), whose economic rights supersede the content producers? And why?
> whose economic rights supersede the content producers?
The owner of the computer they're insisting implements their business logic. It's trivial to simply not send the article to someone they do not want to view it.
If the extension moves on towards sharing an account, P2P distribution, etc, you would have a point. But as it is, it's only action is to interpret the content in a different way than the publisher desires.
Let's say an abutter of a drive-in theater sets up their own seats and starts selling tickets. The intent to "see a movie for cheap" would only become relevant if coupled with some action that is actually illegal.
This is the best idea here. What's funny is that the news sites in their typical technical incompetence are actually way far behind in this battle. Spoofing user agent does not work anymore on most 'techy' sites who have quality software engineering. Analyzing user agent is preschool tier blocking these days. If the news sites want to get serious they need to use browser fingerprinting to detect human behavior and only accept Googlebot user agents from Google IPs. They are basically complaining about something that they are too technically incompetent to solve themselves.
Your first paragraph reads a bit crazy and I imagine that's why you're being downvoted, but as you're expanding your idea in the second paragraph I think you might have a point.
Mind you I'm using Firefox 61 (current version is 63). I switched off auto-updates when it kept changing my user interface and trashing the extensions I need to use to make the web half-usable (e.g. Adblock Plus, Bypass Paywalls, Disable Javascript, Font Contrast Fix, Stylish).
I'm guessing Firefox 63 doesn't let you run Bypass Paywalls, then? I suspect if fucks up other stuff, though I'm not trying it to find out.
If Firefox want to increase their market share, a good start would be not to make changes that are actively hostile to the user.
Perhaps ask Mozilla if they could have it not be displayed in the legal jurisdiction it's accused of illegal, but have it keep on being displayed in all other jurisdictions?
The backwards laws of one jurisdiction shouldn't enable take downs across all of them.
I'd just move on. To be honest sites with those types of paywalls should not be indexed. The loophole you are taking advantage of here is a bait and switch by these sites. They want the search traffic but don't want public access. Most of us have already adapted, however, and avoid these sites or pay for them.
Your plugin title blatantly describes that you're avoiding paying for something they are charging for so even though it may not be illegal it's not something I'd waste energy fighting for.
How is that bait and switch? Their content, their rules.
Its like saying some people get Nike shoes for free in exchange for a review. And when I ask for it, or even take it, they have a problem with it.
I think with physical goods we have an innate understanding of what constitutes as theft. Just because the distribution cost is zero doesn't make digital costs free-for-all.
It is a strained metaphor. What I was trying to say is that clicking on a search result and getting a paywall instead of the content alluded to on the search page is not expected behavior to the end user.
It’s a common misconception that the word “effective,” as used in the respective legislation, was intended to mean “successful” or “always cause.” Rather, it’s always been interpreted to mean, “is designed or intended to have the effect of.”
The fact that the measure is not always successful or is breakable does not make the law no longer applicable; that would be an absurd result. The law isn’t interpreted literally when the result would be absurd; this is doctrine that goes back to at least 1892 and even further back to English common law. See, e.g., Holy Trinity Church v. United States, 143 U.S. 457 (1892).
> a technological measure “effectively controls access to a work” if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.
With this definition does you opinion change? I mean this user agent isn't a secret information - this provides weaker access control than not advertising a public URL.
> Checking user agent doesn't meet the requirement to be considered an effective access control technological measure.
I highly doubt that. Keep in mind that age restrictions which make you hit a single button to circumvent them are much worse in keeping the wrong users out, and afaik legally they're perfectly fine.
"Effective access control" means they have to do something which may work to some degree and doesn't have to be a burden financially or technically.
Ah, but in this case we're provided a definition:
> a technological measure “effectively controls access to a work” if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.
Would you be making the same argument if we were talking about your bank's website?
IMO Effective access control works both ways. you can't send the ALL of the content back and then have the access control work on the client machine.
What if i just used curl and viewed the HTML raw to read the article?
I would consult with an attorney to determine legal options for an adequate defense and expected expenses. A consult is not a contract and you can change your mind if you are unwilling to take the risk with a law suit.
I suspect the take down notice is a DMCA take down based upon an flawed assumption of the law. The hard part about this is arguing the technical merits of the case before non-technical people. While the take down notice is probably in error they could still make a good argument around bypassing their security controls.
You could appeal to the EFF or ACLU. If they are willing to take your case it will be pro bono.
I'm not sure if this has already been suggested, but if it hasn't been, then maybe you could market/describe your add-on as one that prevents sneaky websites from tracking you.
And instead of calling it a anti-paywall add-on, instead call it a anti-tracking add-on.
If you do that though, you may be asked to explain the list of websites for which the add-on activates. I guess you'll need to have some sort of "valid" explanation for that.
How about stop the development? The fact that you can break the paywall (easily) doesn't give you the right to do it. Current laws (in that country) state that it's ilegal, so why do you insist in doing it?
Paywalls aren’t enshrined by any law. You’re misinformed.
the web is public, despite SV’s best attempts to subvert and exploit that. If you don’t want someone accessing information don’t publish it as a website that anyone can access.
So is that's your fundamental issue with a paywall? Anything that's available to Google (and Bing, DDG, etc) should also be available to you at no cost?
Restating that from the other perspective: if the information isn't universally available for no cost, it cannot be looked up via a search engine?
Uh yeah. I'm assuming you know how HTTP works, but if not, _basically_ you send a request to GET content, and the server makes a decision on what/whether or not to return. If that user shouldn't be able to see the content because they haven't logged in then its up to the server to decide.
It's crazy to send them the content but tell them not to read it... back to your example would you expect your bank to do that? Here's all the account details and transactions but oops thats not your account. I'm guessing no, you'd hold your bank to a high technical standard.
To be clear, if newspapers/journalists want to work out some special agreement with google (or partner/agreed upon indexers) so their requests are authenticated so that only they have access to the content - i think that is a better solution then pay walls and sending the article and saying "don't read this please"
I agree: it's a crazy strategy. And you're correct: if my bank sent my details to someone with a half-baked attempt to prevent them accessing the data they were given, I'd be getting a new bank.
But regardless of how crazy this scheme is, I don't think it justifies taking advantage of that craziness to unwrap such content.
I think it's reasonable to question the approach of banning the plugin too: the problem is the users' choice to use the plugin, not making it available. But ... when there's no justifiable use for the plugin, and the author clearly intends it to be used to view unauthorized content ... I can see that it's an attractive strategy to just ban it.
I'm less concerned with the implementation than I am with the principle.
In principle, I have reservations about exposing content to search engines but then requiring payment to read it. Especially if it's non-trivial to filter out the sources that require payment.
But a plugin which works around an attempt to restrict visibility of content to those who've paid for it ... I thnk the intent here is wrong.
I think it's ok to have information that's only accessible to a restricted set of viewers.
It's not that it's not possible. It's not that the implementations aren't dumb. It's that the principle of "if I want it, and I can do it, then it's ok" doesn't really hold up, IMO.
You could make moral arguments for and against the companies seeking these protections and even Mozilla itself.
Ultimately businesses will always ruthlessly try to make more money, and software will ruthlessly seek a more efficient user experience.
Often these objective clash. Spotify is the obvious example that seemed to offer a solution in the music space. But we have yet to discover such a solution in online publishing.
How about paying? That will let you do more, in less time, and won't require an extra browser plugin, which means that it will use even less resources than using a plugin to bypass the paywall.
Your lawnmower (your website) is in your backyard (your servers). If I go to your backyard (your servers) and I get/use your lawnmower (your website), I'm 1) trespassing privet property (the paywall) and 2) using something that I'm not allowed to use (your lawnmower, your website that requires me to pay for the content).
No matter how easy is it for me to go into your backyard (bypass your paywall), it's still an offense.
If I can download your content by simply changing my user-agent identifier you don't have any security. In this context the backyard is the local computer and web browser. The lawnmower is the content in question. It is deposited and there. If you don't want the user to access your content then don't drop it into their backyard. The user isn't trespassing by accessing content left in their property.
More simple, if you don't want the user to have it then don't give it to them.
In my opinion, the problem is because content owners/producers want a double standard. They want people to pay for access but they also want there content indexed so people can find it. So if this tool makes it so that the site treats me as an indexer than so what?
Have you ever been in a conversation where someone talks about something and you said “hey I read this cool article on that, let me send it to you.” If so, guess what - you were the search engine for that conversation. Should you then have access to view the non-paywalled content?
So yeah, I have no issue with this add on. If they didn’t want the double standard - to allow free access for some and not others - it is easily possible and in their full control to prevent add ons like these (think of any admin site or service for which you have to login before seeing/do anything.)
Content producers have a choice and they’re choosing to be bullies. I have no moral or ethical qualms when it comes to dealing with bullies or double standards.
Why? "The ability to do X gives you the right to do so" is not a moral argument in the slightest. In fact, it is inherently anti-moral, because the entire point of moral codes is "just because you can do X doesn't mean you should do X". I mean, if you can't do something, there's no point in prohibiting it, because it can't be done.
Talking about "the right to do so" is either a legal or a moral judgement, and the parent said this in the context of both a legal and a non-legal (and therefore moral) perspective.
This isn't really about morality, because if were there would be a harm. Nobody is being harmed here. This is about technology, specifically content on the web. In technology the ability to do something absolutely is the right to so do unless you have already agreed otherwise.
If you really REALLY want to make this about morality then I would argue restricting access to available content is the greater moral offense, because it is an inherent violation of liberty.
If you make software for a living, you’re likely earning income in large part due to the fact that not just anyone can copy your software for free.
Writing news is work of perhaps a different subject, but it can’t be denied that like software development, a significant amount of real work goes into that. How can you justify that the authors shouldn’t be able to reasonably expect to have control over their work and expect to be paid for it, if their consumers deem it valuable?
> Writing news is work of perhaps a different subject
Don't care because that is not the subject of this issue not matter how much you wish it were. The subject is whether or not a paywall is adequate for restricting access to content on a public medium. If that restriction is so easily bypassed it is clearly ineffective and inadequate. If you really cared about your business and revenue you would solve this problem instead of complaining about failed value assessments.
> control over their work
Journalists don't have control over their work. Publishers do. This is the same failed argument the music and movie industries peddled from around 1998-2008. Instead of wasting your energy on distribution control spend it on what you are good at and return superior value to your work.
> In technology the ability to do something absolutely is the right to so do unless you have already agreed otherwise.
That's just plain wrong. There's nothing special about technology that means you get to throw all your existing moral principles out the window. The ability to technically do something does not confer you the right do it, either legally or morally.
Maybe if I draw an analogy to patents it might make sense? It seems most people in technology agree that taking something unpatentable and adding "do it on a computer" shouldn't make it patentable. Morality is no different. Taking something immoral, like taking someone else's intellectual property without paying for it, and saying "but do it on a computer" doesn't suddenly make it moral. Taking someone else's IP isn't immoral because you're depriving them of the paper it's printed on (that part is just petty theft), it's immoral because you're depriving them of the right to control the distribution of their IP and the right to get compensated for the work they did in exchange for giving you the right to use the IP.
Which moral principle is in violation? You are serving content and then complaining about people reading it. If you are so interested in protecting your IP then why are you giving it to me anonymously? In no way have I altered your means of distribution.
If I choose to serve my IP to Google in full for free, that doesn't mean I'm choosing to serve it to everybody in full for free. Just because you can trick me into thinking you're Google doesn't give you the moral or the legal right to my content.
Actually it completely does. You don’t own my computer, software, or it’s settings. In accessing your content I am committing no act of fraud or theft since the user agent string is not a qualified identifier.
Are you directly giving it to Google via encrypted tunnel? I am not redefining how any technology works or making any alteration to your distribution or your service. Yet, you are still giving it to me free and anonymous.
Some people think taxes are immoral, but that doesn’t give them the right or ability to redefine the tax code. HTTP is not immoral.
The real issue here is you are lost and confused because you don’t know how to secure your product. Your negligence in accounting for your business, financial model, and IP is not my lack of morality. Fix your technology.
What makes you think that the technical ability to do something confers either the legal or moral right to do that? Just because it's technically possible for you to trick me into thinking you're Google does not mean it's ok for you to do that. You tricked me into giving you something I thought I was giving to someone else; that doesn't mean you have permission to do this, that just means you tricked me. Neither legality nor socially-accepted morality recognizes that successfully tricking someone confers the right to the results of the trickery. In fact, both are pretty explicit about how this is wrong.
> What makes you think that the technical ability to do something confers either the legal or moral right to do that?
Because I am operating squarely within the specification, designs, and intentions of the technology. When this is not the case there are two possible outcomes: a defect or missing security.
The absence of security or warning thereupon is an implied invitation. This is why, at least in the US, a warning must clearly be stated before trespassing can be enforced. In this case it isn't even remotely confused with trespassing because you are giving me the prize simply by my asking for it without any regard for who or where I am.
We can invent all kinds of fictions as to why this is right or wrong. More important is whether I am violating security (there is none to violate) or violating technology (clearly I am using HTTP properly). Ultimately this distills down to one question:
If you don't want me to access a given content then why are you giving it to me anonymously?
The answer to that question determines why the use of a technology qualifies the usage behavior.
> Just because it's technically possible for you to trick me into thinking you're Google does not mean it's ok for you to do that.
Why is that not okay?
> You tricked me into giving you something I thought I was giving to someone else
I did no such thing, because you never asked who I was. Would you give your car keys to a complete stranger assuming they are a valet without any consideration as to whether they are who they claim? If in this case the car is stolen what is your expected recourse?
> that doesn't mean you have permission to do this
It is perfectly legal to modify my user agent identifier for any reason at any time. It is my computer, my software, and my settings.
> that just means you tricked me
How could I have tricked you? You never bothered to ask. This is how this technology qualifies its use in this way. You made a faulty assumption and are shifting the blame for that assumption. You can continue to be upset about this, but you will continue to hand me the content that you wish to protect without any legal recourse or restitution.
If this were my business I would abandon this irrational commitment to a failed idea and either secure my financial model or just open it up.
> Because I am operating squarely within the specification, designs, and intentions of the technology.
No you aren't. The intent is "Give Google the complete text, put up a paywall for everyone else". The fact that the technical implementation does not perfectly express this intent does not mean you can pretend the intent is different.
> The absence of security or warning thereupon is an implied invitation.
Nope.
> This is why, at least in the US, a warning must clearly be stated before trespassing can be enforced.
This is wildly incorrect when it comes to computers. The CFAA does not require any sort of warning in order to determine that a user has overstepped their authority.
This isn't even true in the physical world. Many states require notice that you're trespassing before you're criminally liable, but "many states" does not equal all states. And even in the states where this is true, the absence of a notice is not at all an "implied invitation", it just means you're not criminally liable if you weren't informed that you didn't have permission to be there.
> If you don't want me to access a given content then why are you giving it to me anonymously?
Because you tricked me.
The fact that you fooled me into thinking you're someone else does not give you the legal or moral right to the results. Neither legality nor morality is a game, where if you can just figure out the right loopholes you can get away scot-free. That's not how it works. Not in the real world, and not in computers either. The word that describes what you're doing is "fraud".
Just because it's easy to trick me does not make it right to do so. Your entire argument boils down to "if you didn't want to be tricked, you should have tried harder". That's not a moral argument. The ease of tricking me does not in any way affect whether it's ok.
As an analogy, let's say I'm a baker, and to celebrate my dear mother Alice's birthday, I decide to give away a slice of cake today to anybody named Alice that comes into my shop. I'm not a suspicious soul by nature, so if someone walks up and says "Hi I'm Alice" I'm inclined to believe them. I'm not advertising this anywhere, there's no sign saying "If you introduce yourself as Alice you get free cake", it's just something I'm doing. If you hear about this (say, you have a friend named Alice and she tells you about the free cake she got), do you think you're morally justified in walking into my shop and saying "Hi I'm Alice"? Sure, the damages are pretty small, but you're still lying to get something you know you're not entitled to, with no justification other than you want it.
I think you are aware but irrationally refusing to accept that HTTP is public and anonymous by default. That is the only defense a person would need to destroy you in court in a counter-suit. Why would you leave your business so openly exposed to this risk?
>> The absence of security or warning thereupon is an implied invitation.
>
> Nope.
You should consult an attorney. There is ample case law on this. This is how the military learned, the hard way, to impose warning banners.
> This is wildly incorrect when it comes to computers.
It still applies. There is legal precedent. CFAA does not apply in this case. In order for it to apply I, as a user, would have to knowingly overstep my authorized privilege level, which is commonly referred to as privilege escalation. This is explained in the Wikipedia article for CFAA.
> the absence of a notice is not at all an "implied invitation"
It is in the case where entry is anonymous and public, such as a store. HTTP is anonymous and public.
> Because you tricked me.
How could I have tricked you if HTTP is anonymous and public and was never asked to identify myself? I am an unknown stranger like every other requestor.
> The fact that you fooled me
I did no such thing. You never asked who I am. Had you asked I would tell you and then can you can decide if you would like to grant me access to the content. Instead you guessed incorrectly. Your bad judgement is not my fraud because HTTP is public and anonymous.
> Neither legality nor morality is a game
I keep trying to point this out to you but you would rather irrationally maintain your commitment to a failed idea and leave your business fully exposed. I did cyber security work for the military for about a decade, so I am fully aware of what the risks, technology, and laws are. If you were to serve me with a DMCA take down notice for anti-paywall software I would take you to court and I anticipate I would likely win. You really don't want that to happen. Why are you exposing yourself in this way?
> Just because it's easy to trick me does not make it right to do so.
Stupid is not a legal defense. Listen to the absurdity of this when rephrased to say the exact same thing: I am totally surprised that nice looking stranger drove away in my car after I voluntarily gave him the keys. Just who does he think he is? I know this will be all cleared up once the police find my car with the signed title in the glove box proving ownership. It was wrong for him to look like a banker. The imposter tricked me. How morally repugnant.
> Your entire argument boils down to "if you didn't want to be tricked, you should have tried harder".
That understates the absent mindedness of your position, but yes. It may or may not be moral, but it quite often the more legally valid point of view, particularly when there is a provable expectation of knowledge and risks.
> do you think you're morally justified in walking into my shop and saying "Hi I'm Alice"?
Yes, because free cake is great (since you're offering), and I think you will run out of cake. If I were the baker I would attempt to validate the person by asking for a phone number, address, or to see their ID. Stores already do this, which is why your scenario is absurd. If this scenario were a real thing it could backfire by resulting in a potential discrimination claim.
> I think you are aware but irrationally refusing to accept that HTTP is public and anonymous by default.
That has literally no bearing whatsoever on the morality of pretending to be someone else in order to get access to IP that you don't have the right to access. This is the second time you're calling me irrational, and it's not acceptable.
I am not pretending to be anybody. I am anonymous. This is how HTTP works. That is why you should either be asking your users who they are or stop pretending to care that it is important.
I used the word irrational in the context (both times) of commitment. This is an accepted description in behavioral health literature and does not address you as a person. It is also not polite to accuse people of tricky (fraud) when there is no evidence of such.
Please don't paint both parties to an argument with the same brush. I was on my best behavior for this argument and did not engage in a "tit-for-tat". I do not appreciate being officially reprimanded and having my comments flagged when I did nothing wrong.
I'm not expecting a response (heck, I'm expecting this comment to be flagged for arguing with a moderator), I'm just hoping you'll pause for a moment and realize that heavy-handed moderation is counterproductive; if I'm punished for being on my best behavior, what incentive is there for me to care about my behavior at all?
Whenever we get one of these snippy exchanges going far to the right on the page, circulating uselessly and boring everybody else, both parties are to blame for keeping it going.
Any time you find yourself writing things like "This is the second time you're calling me irrational, and it's not acceptable," you've passed the kind of discussion we want on HN. Even if it's true that the other person was behaving as badly or worse.
The point of that comment was to signal that the discussion was over. I agree that the discussion had passed a line; that's precisely why I wrote the comment, and why I ignored the reply. I was self-moderating. It seems both ironic and counter-productive for a moderator to yell at me for ending the discussion, with the explanation that the discussion should be ended.
But really, it's not the fact that this comment was flagged that bothers me (though being accused of "tit-for-tat" behavior still rankles). What really gets me is my previous comment (https://news.ycombinator.com/item?id=18604446) is flagged as well, for no reason I can see.
As before, I'm not actually expecting a reply. I know you want this whole discussion to be over, and I'm fine with that. I just want you to spend a few seconds thinking about what I'm saying here.
It's far from clear that draw-on-top paywalls qualify for the protection offered by either the DMCA or the CFAA. Even if they did, the mechanisms by which this specific extension works are indistinguishable actions users take for many other reasons. The legal notice is a gamble that the extension author doesn't want to spend the money to find out the hard way.
That's an entirely serious suggestion. I'm not arguing that what you're doing is illegal. I have all sorts of qualms with copyright and its enforcement myself. If I were "copyright czar", movies would get three years, and newspapers maybe a week.
But if we wish for copyright-holders to respect the rights of internet users, it would seem to be a winning proposition to maybe not actively work against their attempts to find a compromise.
And a "soft paywall" that allows you to read a dozen or so articles per month without subscription seems to be jus that: a compromise, and a reasonable one at that.
What do you expect to be the long-term outcome of bypassing such mechanisms? I have trouble of thinking of anything but "soft paywalls" turning into "hard paywalls". Then, we'll be left with the maybe one or two publications we subscribe to. How can such an outcome be in anyone's interest?
I know you can bypass these schemes. Yes, they are laughable. I know ads are sometimes annoying. I know large swaths of the press have earned your scorn because they, like, use the wrong JS framework. Or something.
But I still don't understand this attitude that appears to go even further than just "I want it for free" to an almost gleeful appreciation of vandalism destroying the foundations of democratic societies.
You're willing to wage an awful lot on the proposition that there is another business model, even though both you as well as thousands of now-bancrupt publishers have failed to find it.
Also: your own business model of "living" is just held up by the completely artificial rule of others not taking everything you own. Just because "it's on the internet" doesn't make "might is right" a true proposition.
> You're willing to wage an awful lot on the proposition that there is another business model,
No, for a business model not to work doesn't mean that there has to be another business model that will allow you to run exactly the same business. If I need to fish with dynamite to make fishing in a particular area profitable, and dynamite becomes illegal, it's no one's responsibility to come up with another way I can fish.
I dont have a business model based on living as a general rule, or elsewise some people owe me some money :)
And no, that's not a fair analogy, its me saying that if you tell me something, I am not beholden on your instructions to forget it.
You simply have to use something as simple as a lock and key and I will be forever stopped from knowing the thing (in reality).
All news orgs have this option, they simply want the cake and eat it too of working with popular search engines and also charge users for information that they effectively already have.
If you want to operate a private service go for it, nobody is going to complain about it, and any unauthorized access will be met with scorn (at the least.)
edit: also I am not just willing to wage failed business models all day - clinging to things that dont work isnt a way towards success.
My two cents is that advertisement is what is killing journalism.
YouTube, for example, can show advertisements for well known companies in videos about Anti-vaccination, far-right conspiracies, etc. without consequences.
Why is that? Because all that happens in the privacy of your own computer. Usually any newspaper that publicly have printed such bullshit in their pages will be dead. Public will react to it.
What is different? Facebook, YouTube, etc. are personalized. You are shown what you are interested in without public accountability. Niche radical content gets a lot of views for its own controversial nature. Views and money.
Who wants to investigate, hire good writers and expend the money that it takes to write a good article when you can hire some one without ethics for a fraction of the price and get as many or more views as radicalization grows?
YouTube, Facebook and others say that they are not responsible of the content they offer. I think that it should be true for things like comments. But for the monetized content they are 100% responsible of incentivizing that radicalization and killing good journalism in the process.
> YouTube, for example, can show advertisements for well known companies in videos about Anti-vaccination, far-right conspiracies, etc. without consequences.
It is a myth that there is any problem with ads being shown on controversial videos. YouTube demonetizing select videos is nothing more than a way to strangle independent media and help gentrify their platform.
Multiple news orgs have stated in public that they don't care about paywalls bypassers because they put up the paywall to convert only the most amenable readers. This is very similar to the paper distribution model where an extreme minority of subscribers represented the majority of revenue, due to extreme discounts and other subsidies given to most readers.
That's true, but it's also on the assumption that the paywall adds just enough friction and reminds readers "you know, if you like this, eventually you might think about paying for it." Some will. Some won't.
Automating the process by pretending to be Google means the user won't even see that friction or messaging. It's clever, but it breaks the premise.
Then these websites should block the ability of search engine crawlers from accessing their paywalled content, which is basically moving the content out of the clear web onto the deep web (which is not the dark web, there's a difference).
If they can't accept that compromise and not have these paywalled articles indexed, then the problem is on them.
They can even have a summary or introductory paragraph indexed while designing a paywall that way. What they can't have is search engines able to read the whole article and not everyone else.
I think this is fair, and so do the search engines. Google calls doing otherwise "cloaking" and says they penalize the ranking of sites that do it. Perhaps they're not doing so effectively enough.
I’ve responded elsewhere in this thread but I’d like to discuss the double standard being applied.
Have you ever been in a conversation where someone talks about something and you said “hey I read this cool article on that, let me send it to you?” If so, guess what - you were the search engine for that conversation. Should you then have access to view the non-paywalled content?
Simply because the words could be applied to another situation doesn’t mean no thought was put into them. So no, I do not realize that the argument is vacuous.
I’ve simply stated that you can either fight change or embrace it.
In this context I mean that many web users do not want to view their content with advertisements or be tracked through advertising. Attempting to force them to is to push against user behavior (fighting change).
I don’t believe users will change their behavior if you try and force them to.
I believe that by embracing the users behaviour we can learn how to make it work.
I think that might require letting go of our predetermined notions of what “journalism” is and how it should be funded. I think we need to be more open to reviewing why people paid for journalism in the first place and how the need it fulfilled is met today.
“Harmful changes should be fought” - Harmful is a pretty context dependent word in this situation.
“Journalism places a vital role in democracies” - what role is that? (I’m not disagreeing, I simply want to know your opinion).
“Journalism is expensive” - does it need to be? Why is that?
“Someone needs to pay for it” - This seems quite vacuous. If the thing is valuable then someone will likely pay for it (if they can be convinced of the value and it’s realized).
It’s not readers who pay for it now though is it? It’s advertising companies since they buy the ads. We’re not asking people to pay for it we’re asking them to be visually and audibly distracted into buying products and services in return for journalism.
This extension just seems to strip tracking data and pretend to be a Google bot. It baffles me that this is somehow concerning enough to be taken down. And anyway, isn't making exemptions for Google's robots sort-of against their policy?
That's exactly what I thought too, not even " sort-of " it seems "without a doubt" against that policy. It seems really tricky for Google to enforce though. Wouldn't they need to send out bots crawling without the GoogleBot agent? That also seems wrong, somehow.
If I recall correctly, this rule is why googling for an article and then clicking on it from Google frequently works.
The rule is something like "a user clicking from Google can't see something (meaningfully) different than what the Googlebot sees". So you can paywall direct traffic or links from Reddit or internal links, but that first one from Google is supposed to work.
You are not allowed to circumvent paywalls, just like you are not allowed to circumvent locks, no matter how easy they are to circumvent. As far as I have always understood, you may publish a locksmithing guide, even an “entering your home when locked out” guide, but not a “how to commit burglary” guide.
It seems that there is a Canadian case that confirms the validity of paywalls as a "technical protection measure". While in the case, the circumvention was social(obtain copy from another subscriber), I doubt circumventing it via user agent spoofing would fare better.
The US of course. Look at the list of sites the plugin works for: none of them cares if you ignore their paywall. The likelihood that you would subscribe is negligible. It’s American readers they are after. And for them the jurisprudence is clear. No deliberate subversion of access controls allowed.
The publishers want it both ways. They need to publish their full article content for search crawlers to read but don’t want humans to see it. The idea that this is a form of DRM protected by the DMCA is laughable in my opinion, but IANAL.
>but flawed journalism is better than no journalism.
I would disagree. Flawed journalism means things like mixing in lies in their news stories, mixing in opinion pieces into news etc. That kind of stuff can do more harm than good.
Sufficiently flawed journalism is perhaps one of the most severe problems in our society. People are fed half truths, and at times simply false information, and then go on to repeat it and base their world views upon as if it were fact. And in the era of social media false and sensational views spread incredibly rapidly while any 'corrections' are basically dead on arrival.
To give a very recent example of this, you probably read about a shocking new study showing that the oceans are actually heating up 60% faster than we thought. Turns out the study was mathematically flawed and its actual numbers are not particularly different than what other studies have shown. [1][2][3]. And the error was detected just hours after publication - apparently not quickly enough to stop the shocking headlines. This is not an implied comment on climate change, but rather just a very recent example of this phenomena of how people are misled without having their views ultimately corrected that happens to involve climate change.
The sites that rely on 'teasing' and then paywalling are some of the worst offenders in the state of journalism today, and in my opinion the world, let alone society, would be in a much better place without them.
We can all agree that rewriting science department press releases is a bad idea and that journalists often get it wrong. But I wasn't referring to shoddy journalism, naked propaganda, click bait, or low-quality churnalism. My point was that no journalist or publication is perfect, but some are good enough, and what they do is expensive, necessary, and deserving of support.
What I was saying is that journalism, in its current state, often runs sensational stories that later end up being false or otherwise unsupported. That report I mentioned was not about the media rewriting a science publication -- the publication itself was published with errors in it. The media just accurately repeated those falsehoods. The problem is that, due to the nature of social media, the sensational stories get let's say a million hits. Later on they either update the story to more accurately reflect the truth or run a retraction. These 'corrections', by contrast get maybe a hundred hits. So you have people who have wildly broken worldviews largely because they take the media at face value.
The following quote from Thomas Jefferson is dated 1807, but it's now more relevant than ever simply because mass media is resulting in mass misinformation: "Nothing can now be believed which is seen in a newspaper. Truth itself becomes suspicious by being put into that polluted vehicle. The real extent of this state of misinformation is known only to those who are in situations to confront facts within their knowledge with the lies of the day. I will add, that the man who never looks into a newspaper is better informed than he who reads them; inasmuch as he who knows nothing is nearer to truth than he whose mind is filled with falsehoods & errors. He who reads nothing will still learn the great facts, and the details are all false."
How is that remotely relevant to the topic under discussion? I mean, it's true that laws are sometimes unethical or mistaken. But that has nothing to do with whether journalism is useful and worth protecting.
In western societies, nobody commits crimes to literally survive. And, if they do, it is generally accepted as an excuse.
(c.f. the bishop of Cologne, Germany, regarding the theft of basic foodstuffs during the famine immediately after WW2)
A wish to survive is also an accepted excuse in many other cases of behaviour that would otherwise be considered criminal. You can even kill someone and get out of it with a credible claim of self-defence.
Then implement technological measures to make sure that this is the case. At the very least, don't just make data freely available to the user and expect them not to read it, just because you visually hid it! And if you're serving non-paywall pages to Google bots, that's kind of against Google's policy, isn't it?
That's a great discussion to be had anywhere but on an HN thread about how those same organizations are trying to create a precedent for limiting the kind of software you can choose to run on your own computer.
These organizations are making the issue harder and harder for themselves by consistently arguing for insane concessions from society and other companies after they were caught napping during the biggest technological revolution in their business since the printing press. We should definitely have discussions on how to have a healthy press in the digital age but that should never include putting up with bullshit like this
If he felt that way, he would probably have a subscription. I will reiterate what several other posters have said: it's up to publications like WSJ to ensure their content isn't available to unauthorized users. If they're sending content out, they should not be upset that it's being consumed.
I've read stormfront threads, too. Additionally, it just seems incoherent to me to pay for things that I read; I pay for things that I want other people to read.
>They need to publish their full article content for search crawlers to read
At first, I thought it might be possible to solve this by getting search engines to standardize on a vector format that they could accept for protected content. So the crawler sees a 300-dimensional vector that effectively gives a semantic summary of the document.
But then I thought content providers could achieve a substantially-similar effect by just serving their documents to search engines in scrambled (e.g. alphabetized) form. They could still provide normal headlines to get them clicks.
BUT THEN I thought it would be a really cool and bizarre problem to circumvent this by attempting to devise a method for finding the most-probable original document given its alphabetized version.
This breaks the social contract of the web. If you publish on the web (over HTTP) using HTML (with or without css+js) then you respect the concept of a User-Agent that renders the content on behalf of the user. If you wish to get around this then create another file format and protocol and application/plugin to do so — one that enforces the DRM for the owner. Don’t take agency away from User-Agent.
Precisely this. Website operators who wish to establish effective paywalls with publicly indexed content need a way to cryptographically authenticate web crawlers. That means working with search engines to establish a standard for registering and authenticating authorized crawlers.
If Google isn't interested in such a standard (because it reduces the quality of open search results) then that's the publishers' problem, not Google's or users'.
HTTP is public by default and SMTP is private by default. The laws respecting this in the US are pretty solid, especially for email. In the US privacy generally trumps public access which allows email to retain its private by default status even if served over HTTP (web mail).
That said anybody attempting to make parts of content non-pubic in HTTP without appropriate security restrictions are void the protections of law. The remedy for this is to ensure necessary security is in place so that non-pubic content is limited to account and session, which then puts part of the burden on the end user to ensure they restrict the credentials that provide access.
Content, not already covered, served over HTTP without the necessary security in place is not private.
There is a clause in the DCMA that makes it illegal to circumvent security controls. The stipulation there is that the security controls in question must be adequate and reasonable. Dropping a CSS model over some content is not a valid security control, and thus has no legal protection. Of course everything regarding DCMA is open to argument at legal expense.
It’s a common misconception that the word “effective,” as used in the respective legislation, was intended to mean “successful” or “always cause.” Rather, it’s always been interpreted to mean, “is designed to have the effect of.”
The fact that the measure is not always successful or is breakable does not make the law no longer applicable; that would be an absurd result. The law isn’t interpreted literally when the result would be absurd; this is doctrine that goes back to at least 1892 and even further back to English common law. See, e.g., Holy Trinity Church v. United States, 143 U.S. 457 (1892).
Engineers too often assume that the text of the law means what they think it means. This is one of those cases where a lack of legal education serves them poorly and leads them to incorrect conclusions.
Quick question. If one group intends a grossly inadequate effort to be a layer of security and another party ignores that effort who is in error? It could be argued that if the supposed security measure is so poorly conceived the bypassing party presumed it to be an error and thus used their software knowledge to mitigate the defect. On one hand there is an intentional barrier to restrict access to content while on the other hand the intention is to serve content and so the bypassing party assists that service intention.
I am of the bias that a space of technology cannot be summarily redefined by a single group interest merely to compensate their financial insecurity.
To make a long story short, the law to date has always been on the side of the property owner/rights holder insofar as these sorts of questions are concerned. You can’t presume that just because the door is swinging open in the breeze that it constitutes an invitation to enter or that you can fix the defect on someone else’s behalf without repercussions. Context matters in the law, just as it does in the real world.
> If you visit stuff on the web, you respect the concept of a social contract between you and the provide.
If I send a site an http GET request, and that site responds by giving me some data, then that site has given me implied consent to look at the data. If they don't want me to look at it, they shouldn't have given me it.
^ THIS! I don’t see how the situation is in any way more complicated.
Real-world analogies can get pretty squirrelly but it would be quite literally like the following.
Man standing on the sidewalk outside a store yells into the store at the shopkeeper “hey there, can I have some free fish?”
Shopkeeper yells back “sure!” and tosses a fish to the man on the sidewalk.
Add more yelling back and forth for TLS handshake.
At this point, the man on the sidewalk can do whatever he wants with the fish. It was freely given.
Off topic: isn't this how user privacy works too though? People complain about companies like Google and Facebook "stealing their data," but it's their browsers sending out the data. If users don't want Google to have the data then they shouldn't send it to Google.
Basically this example, if accepted in law, would mean that if you want your data to be private then Google would be expected to respect that, even if you sent them that data in the clear.
This has nothing to do with ad blockers, or indeed advertising at all. The way it works is they set the user-agent to one used by search engines. The website thinks you are Google, so they give you the content for free because they want Google to index their proprietary content.
> Alternatively, the add-ons break the social contract, whereby content creators request payment for their content.
The site is free to not emit any content before payment is assured. The reason these add-ons are possible is that these sites are trying to have their cake and eat it to. They want to implement the paywall in the user agent so they can still get their content in Google. At the same time some of them are trying to argue for payments from Google for linking to their content. The situation is a mess but it's not about social contracts at all.
Anybody who tries to show me ads clearly respects neither my time nor my money, so why would I respect theirs? Anyway, getting angry at ad-blocking is pretty silly - it's as if someone threw a pamphlet at me while I was talking to them, and then yelled at me because I didn't read it.
These are competing and potentially incompatible social contracts. As a hacker type who's been on the web a good while, I prefer the former: the client decides how to render content, and the server should not send content it doesn't want rendered.
This doesn't necessarily prohibit the use of paywalls: the paywalled site just has to be designed so that it only sends content to clients that have provided evidence of payment rather than relying on the content being rendered in a way that prevents the reader from reading all of it.
Much as I'm for standards-compliant HTML rendering, I don't want any specific rendering encoded into law.
Sure...except that the page content is loaded before any payment is made or confirmed. Websites probably want this to happen so that some user agents will not be blocked by the paywall e.g. search engine crawlers.
Basically it sounds like some publishers want to rewrite the rules of the web to neatly and conveniently serve their interests.
It's obviously not a "request" if they're making legal threats. And it's not payment they're demanding, it's the ability to track anybody who visits their site, whether or not you agree to be tracked. And it's not part of any social contract I agreed to; the (very short) history of the web is an ongoing negotiation. Paywalls were invented this decade. This plugin is part of that negotiation.
Browsers already have a mechanism for authorizing access to content. Many mechanisms, really. If a company chooses to use an unreliable mechanism, I don't think we are morally obligate to roll over and do what they want.
This is mostly about "soft" paywalls, allowing you to read maybe a dozen articles per month without paying.
There is currently no way I know of allowing this functionality that is meaningfully "reliable". At least not without erecting new barriers such as mandatory registration (and verification).
So you, and everyone else, seem to be demanding publishers just switch to "absolute paywalls". You will then have strictly less access than before.
I'm not demanding publishers switch to anything. Personally, I like the soft paywall system. I also think people who bypass it were never going to pay money, so I think publishers freaking out about people opening up an incognito window are wasting their time.
But if publisher do want absolute control over who views their content, then they should make people log in. I think that would be a mistake, but it's their mistake to make. I'm just opposed to give them legal control over what I do with my computer and any data their servers freely give me.
Prohibiting paywall bypass software violates the principle that the client dictates how web pages are rendered, or requires carving out a special exception just for the publishing industry.
Viewed under a magnifying glass, it seems like a good thing to ensure the publishing industry can use soft paywalls, but taking a broader view, I think that breaks the web. I don't think soft paywalls are worth breaking the web, and even more broadly, governments should only regulate what users can do with data willingly sent to their computers in very exceptional circumstances.
This seems to be a classic example of an argument in which the ends don't justify the means (the means being allowing the lawsuits, the ends being publishers switch to "absolute paywalls")
It may mean that without a harsh letigious method, publishers do not offer "soft paywalls". It's more likely they will continue to do so to not be shut out of the market, AND we won't have waves of frivolous harsh lawsuits bankrupting independent developers.
The alternative you're proposing is to in effect be held to ransom by content providers - your argument could equally be made for any form of drm or appeasement (without root how do we know you are not recording this, wothout your location how do we know you are within our licensing area, without direct retinal scans how do we know who is really watching, etc)
Sorry, I specifically mean the "soft" paywall, which is the kind at issue here. If these publishers had required people to log in, no browser extension could bypass that.
Would you make the same point for an extension that allows users to easily participate in DDOS attacks?
Edit: the link, for the willfully dense, is that some protocol specification does not imply its users’ acceptance of any and all (ab)uses possible. It’s completely different only in that you like one but not the other.
That's completely and utterly unrelated to what the guy said. He is talking about user-agents and the way you interpret the data you receive from a http(s) request. You're talking about DDOS attacks. There is no logical link here.
Uh... yes? It's not very relevant, but I guess if someone was making some kind of hacktivist extension that did something like that, I wouldn't just take it down from the marketplace.
There’s also a social contract about respect for the law. It’s arguably much older. It involves aspects like “following the spirit of the law”. Also “technical ability is not the same as permission”. It’s why the old shopkeeper’s waning ability to see is no license for you from the produce displayed outside.
(This is mostly to show that I, too, can argue with invented “contracts”).
If you’re selling something called wood, and I use a saw to cut it, I expect it to work because I paid for wood. That’s the implied contract. If the person who sells the wood puts some foreign substance in it to circumvent my saw I should not get in trouble for finding another way to cut it.
I pay for my internet connection and I expect others who make use of the same network to follow its protocols. I expect HTTP to work as HTTP. If a bad network node chooses to circumvent how it works and I find a way around their circumvention then I should not be punished. On the other hand, if I republish and break copyright it is an entirely different matter.
If I notice the shopkeeper gives discounts to people wearing hats, is it wrong for me to come back wearing a hat for the discount? If I notice the WSJ sends different content to different user-agents, is it wrong of me to change my user-agent?
There's also a social contract with government, such that laws are supposed to be thoughtfully written to achieve societal optimums, and rebalanced when that's not the case.
We are in an age where information distribution is approximately free. And where the costs of producing information-based products has declined drastically. Paywalls are not any sort of law; they're an attempt by information producers to have their cake and eat it too. They want the abundance of the new, computer-driven world. But they want artificial scarcity, so that they can charge like they did in 1970. My sympathy is with journalists here. But that doesn't mean I have to roll over and let them break the web.
The laws in question here, the DMCA and the CFAA, are both too new and too old to be reflexively bowed to with "OMG spirit of the law!" Too new because they are obviously part of society's attempts to deal with technology, and are equally obviously driven by the interests of people who have piles of money and are trying to protect those piles. And too old because both, but especially the CFAA which was written in 1984, reflect a very early understanding of what computers are, what they're for, and how society should treat them.
As far as I'm concerned, this is an ongoing negotiation. We need to find ways for journalists to get paid. We need to find ways to have a much more informed populace. We need to preserve as much as possible of the freedom computers and networks have given to every individual.
If we want paywalls to be a part of law, then we should have a national debate about whether publishers deserve a special protection so they make all of their content available, let it be downloaded to any computer in the world, and then have that computer enforce any restrictions they think are good ones. We are not obliged to just concede that debate right at the beginning just because you think reading an infinitely replicable article already on your computer is exactly the same thing as stealing a unique piece of fruit from a blind man's store.
Exactly. 99% arguments here are essentially the equivalent to "since Marriott/SPG are horrible at cyber security, I am ENTITLED to use stolen credit cards from their leaks."
It's definitely against their policy in my opinion, but I guess you could make a weak case that this is what the public would see if this was their "first visit".
I've used this same argument against package managers on Linux many times, but apparently people want to keep doing things the centralized way, because all I get when I do is people telling me that I don't know what I'm talking about, and that package managers and centralized repos are easier to use.
Package managers allow you to very trivially add new repo sources which you often have to do if you want packages newer than the packaged version for your distro.
What an utterly stupid trick.
So, I didn't even know those extensions existed. Such arrogant behavior made me search and install one of these.
Serves them right.
Perhaps we should make copyright/censorship an issue on the next election otherwise we end-up with the worst things from both worlds: DRM from US and censorship from China.
Does Mozilla need to actually host the extension? I'm guessing that that is the problem here. Couldn't they just cryptographically sign it, and leave the distribution to a P2P technology like BitTorrent?
Firefox is just a platform to run addons, like Windows is OS to run programs. Do you think that Microsoft should curate software allowed for users to run?
IANAL but my perspective has been that the courts care more about your ability to control what runs on a "platform" than about who hosts what. So if Firefox in its default configuration will only run addons that Mozilla approves, then the courts might not care about where the addon is hosted or how users technically receive it, and could just order Mozilla not to sign the addon.
My personal opinion is that curation is fine if users can opt-out of it. There is value in having someone certifying that the software you are installing is not malware, or even that it meets some threshold for quality (e.g. does not drain the battery), but users should have the ability to pick the curator or to have no curation at all. That said, it is a totally separate argument from whether or not the courts would care about how software is distributed, and totally separate from how the courts will view the role of a software curator (and whether or not courts will insist that curators refuse to certify software that does certain things, like blocking paywalls).
Wouldn't Mozilla just have to say that any add-on that isn't malware is eligible to be signed and that it's a security feature, not a tool for curation of content.
FWIW Microsoft _does_ do this, it's just that the alternative is a click-through warning, whereas it's more difficult to install un-curated addons in Firefox.
No, it would mean that the takedown request is satisfied by the Mozilla revoking signatures on the addons, something which the signer can always do (e.g. at a minimum they can push a new signature key and re-sign all the other addons).
Good point. Is there any legal precedent (in the US) for forcing signature revocation though? It seems to run up against the first amendment since Mozilla would essentially be making a statement that "the addon with hash 1234 does not contain malware", which should be legally protected speech.
There is a website out there that has interviews with about a dozen people who are working on alternative ways of doing the internet. Shallow google isn't throwing anything up I'm afraid.
Edit: Not quite what I thought I remembered but here it is anyway:
Possibly in the form of a very strict, very semantic, almost RSS-like subset of HTML? Something that almost resembles the reader view many modern browsers will convert articles into?
One would imagine this has far less to do with data rendering and more data indexing and filtering (web-crawling access).
If you read the link, Schmidts comments related to the bifurcation of the internet, he gives a simple example of two separate internets - version "USA" and version "China".
It seems in this scenario, the single source of truth for all web data is sandboxed to protect a nations (or the nations citizens) best interests (akin to modern day China, Iran). The new web would look to live in the shadows, where users can submit and view pre-filtered ideas without meddling from gatekeeps (government officials and money men)
The issue with this is data access and the sharing of information becomes limited to those with the "know how"( we are all tech literate these days), or more likely, those with the balls to commit a "crime" and disobey the permissions of "their government". This presents an almost dystopian like scenario where people are afraid to share and receive information their government has not green lighted.
It seems very related to me. This is another thing we're no longer allowed to do on the current internet. Maybe people enough people would rather build a new internet than pay for digital goods.
Huge tangent indeed. If only someone would open a thread or mailing list to discuss the idea . . .
The harrowing thing is, it really does look as though we were / are in the wild west days of internet comms. The more tech savy business and corporations have become, the more they have looked to monetize and lock down the web. This is not what it was supposed to be.
I would rather have a browser plugin that just removed pay walled content from search results anyway. Or one that redirected me to something I would use like Blendle.
I'm not a lawyer. I don't know the particulars of the law. But I presume "blocking", as in the ads are effectively removed, is key. Instead of blocking them, would hiding them, via a div with a higher z-index? Mind you, that doesn't prevent the tracking. But there are other tools for that.
I agree. Ads suck. Maybe there's a legal loophole to avoid them some other way?
Oh my fscking god... the comments in this thread are just... It's like trying to explain to a 5 years old why candys are not free...
If it's behind a paywall, it's because the creators want you to pay for the content. It doesn't matter if you can bypass the paywall with a user agent hack or if you must install daemon tools and use 54 different keygens and cracks and patches and firewalls to block ping-home requests. It just doesn't matter because you're tampering the paywall and getting for free what the creators of the content are willing to charge for.
I mean... how damn brain dead do you have to be to not understand that?
I'm wondering how this is different than add blockers which are allowed in the app stores. In concept it does something very similar: allows the user to circumvent how people get paid for content.
I understand that ads can be more dangerous than paywalls but the end result is the same. Is it just that some lawmakers saw one as okay and the other as not?
How do these add-ons work? For sites with an x-number of free articles a month I have come across an add-on that would clear all local storage for a particular paywalled site. Using a private browsing window would also allow me to view the site paywall-less in those cases, so I didn't need the add-on in those cases.
You either enforce your morals or they don't apply.
Without a paywall access is free to all. Sites may pretend that there is some moral obligation that visitors have to switch off ad blockers, but that's only the site's opinion, clearly not one that others typically accept.
Build a paywall and sites can manage entry based on whatever conditions they wish. Users either log in for some received benefit or go away.
But put up a search engine bypass and they open up access and lose total control. Bypassers are unlikely to agree with the site's desires and viewpoint.
Sites either control access 100%, by login, IP, etc, and so enforce their particular morality or they have to accept that their world view is not shared by all.
Even should sites manage to get a legal framework to enforce this morality, those laws do not have global scope. Not yet anyway.
I think that when you send fake data to a server to bypass a paywall (e.g. sending google UA) then you are using the server without the owner's permission, which makes it immoral.
But in general I believe that being a journalist does not mean that others have to pay you. You as a journalist have to figure out a business model that works.
Even if these extensions can still be installed, without being published on Mozilla's addons site, the average user will be unable to find them. It seems like a really bad precedent for Mozilla to accept this without a fight.
It's permanently disabled in the normal version because malware would piggyback on the browser to steal passwords and so on. Obviously Mozilla have no problem with people wanting to make their own extensions and so on.
Aurora is no more because it was not necessary for stability (when nightly merges to beta it is already very stable, this improved a lot over time) and incurred a cost on speed of development (one less stop for the train to ride). DevEdition is now based on Beta and extremely stable. I use it alongside the stable version on both of my main computers in an equal way and I have max. 1-2 issues in DevEdition in a year (and those issues do not even prevent me from doing my work).
I wonder to what extent that helps prevent malware from installing a malicious addon to Firefox, because by using the same mechanism as cheating in video games, you can hot-patch a running browser process to disable the functionality to keep it from installing unsigned addons. Technically, in Windows you would just call WriteProcessMemory to modify memory content of another process.
It‘s the injection vector. People used to sideload malicious addons a lot by „accident“ when a rogue website told them to („You must install X player to see this video. Click here …“).
Would it be difficult to set up a list of allowed signatures in Firefox? By making it unintuitive for the average user to modify, you would prevent most bad actors from succeeding but still allow power users to control their own experience.
„This cool trick gives your Firefix super powers“ articles will appear instantly. This happened before with noobs following instructions to copy & paste code into the developer console(!), which pwned quite a few Facebook (and other) accounts. Same for banking websites, intranets, … social engineering works well on the unsuspecting. This is btw why browser vendors implemented measurements to make it harder to copy & paste into the dev console, as well as disallowed pasting „javascript:“ URLs to the address bar.
Weird, I have 63.0.3 as far as I see the normal version and had no problem downloading and with that updating the November version of "bypass-paywalls" which was also affected from the releases page here: https://github.com/iamadamdev/bypass-paywalls-firefox/releas...
That means it's signed with Mozilla's signature. Actually, I think extensions can maybe be signed by Mozilla even if they're not on addons.mozilla.org.
Their addon tool includes a well documented facility to sign an extension without listing it in the addon store so you can host it somewhere else. This can e.g. be used for company-internal extensions.
I would even say mozilla invited this to happen by assuming sole authority which addons can get installed. They created a single point of failure. Now that SPOF gets exploited.
I'm not convinced this is a worse evil than the previous situation, which was that any and every crapware installer injected browser plugins/toolbars without consent.
Caveat emptor is always better than a petty dictatorship.
And that's what Moz is being these days; emulating the Apple App model, the Windows Phone app model, and other obnoxious "you have to ask us permission to do stuff on your device" rules.
Id rather take toolbar hell. We'd have more functionality overall.
Of course you would rather take the toolbar hell. Because you're not the one who will be installing random toolbars. This is really no different than saying: "I'd prefer that when a company that has to make a decision that affects millions of users they go with the option that's best for me"
What's somehow worse is that you can literally have your cake and eat it too -- just install Dev or Nightly, you're exactly the advanced user those branches are targeting.
Becuase if they're not I can't imagine not being able to side-load them.
And if they are, with the amount of Firefox forks we have, it should be trivial to create one that allows for side-loading unsigned or 3rd party signed extensions. Hopefully without too much source modification, just creating a distribution of Firefox would easiest to manage.
I‘m pretty sure there is an un-branded release version of Fx on the Mozilla website that allows side-loading and allows disabling the signature verification. I don‘t have a link ready and on mobile so I cannot easily check.
Yes, you should definitely switch to Chrome instead, which has a sterling track record of respecting you as a human and not as a revenue source.
Or maybe knock off the hyperbole and start asking whether there are tradeoffs being made in favor of increased security for the average user. Which does require a more nuanced view than Braveheart-style screaming about freedom.
Why would it be wrong for a publisher to only allow subscribers to read articles? If that is the business model that works in the 21st century then publishers should absolutely do it.
The bigger question is whether or not users should only be allowed to run software the neatly aligns with the publishers' business plans (and those of other corporations -- video game companies, business software vendors, etc.). Personally, I think business plans should be based on reality and not based on courts ordering people to pretend that reality is something else. In this case it is not even hard for publishers to enforce their paywalls -- they can simply refuse to serve page content before the payment is made, instead of just asking the browser to not render the content (which is like handing someone a newspaper and then saying, "don't read anything until you pay!").
I don't think current trends indicate hard paywalls as the future. Instead, it looks like news organizations are going to publish exclusively into walled gardens like FB.
Which outside of admitting the complete dependence of news on social distribution platforms is pretty much what journalists actually want -- a low-friction account you can use to enforce free tiers.
here we go -- gearing up to the decade of censorship 2020 and beyond . . . between this and the EU link sharing tax, I am beginning to wonder if the internet really is the last bastion to freedom of speech
This is not a free speech issue at all, nor are the EU regulations free speech issues.
The problem with these laws and their interpretation is that they target the wrong organizations and technologies. If a website is illegal, it needs to be taken down by police. Instead, idiot judges rule that certain DNS entries should be blocked. If you shouldn't be allowed to read some pay-walled journal, then the publisher has to implement proper DRM. Instead, they take down arbitrary plugins from the directories of arbitrary browser makers.
It's the publishers' right to ask for money for their products, but it's also their obligation to protect it and ensure that their business model is viable and technically feasible.
It's the end of 2018 and lawmakers and executive still don't understand how the Internet works. That's the problem.
One country cannot police Internet, otherwise China will shut it down tomorrow. If a site is legal in the country where it is hosted, then it is legal and that's it, connecting to Internet assumes you obey this simple rule.
No, a country has sovereignty on its territory and can do whatever they want, including blocking whatever websites they want and not giving a crap about whom they offend.
This is why you need to follow the law in the countries wher the service is operational, otherwise the service risks being blocked at the very least.
Of course, countries have trade agreements and the circumstances under which services and products can be blocked is negotiable. And this can cut both ways, e.g. companies in the US selling services and products in the EU have to be lawful in the EU, otherwise they can be fined, even without a presence in the EU. This is why most US companies selling their services in the EU have started charging VAT, even if the US has no such thing.
As to your remark, a website can be at the same time legal in one country and illegal in another. What can happen next depends on the country you’re talking about and the trade agreements that are in place.
But generally, when we’re talking about avoiding payments and taxes, you’d better live in a country with no extradition agreements.
It is not about sovereignty, it is about jurisdiction. If a site on Internet in a different country is upsetting you, you cannot simply shut it down just because you can convince a judge to do it. The law in your country does not apply to the site in a different country.
In the same way, you completely misunderstood how VAT works: when you sell something in EU you collect VAT, but only when the buyer is there and only if you have any presence as a seller in EU. If a EU citizen buys something in Wallmart in New York, Wallmart is paying no VAT.
And speaking of big organizations like Mozilla or Google, they have to comply with the laws of the countries they operate in. Meaning that they need to block browser extensions in the countries in which they are unlawful and they received a take down request.
So in this case Mozilla would need to block extensions based on jurisdiction. For which they'd need to track their user's location while they are using said extensions, like various websites or game platforms are doing, but which for Mozilla would be a privacy nightmare.
What would you rather have? A browser that tracks extension usage in real time, or a browser that bans those extensions from their repository? At the very least the easier path is the later.
“Just take down the website” is disingenuous. You, and I, and those idiot judges all know it’s often much harder, and sometimes impossible, to get to the website owners.
“Abolish all copyright” is a legitimate opinion. It’s wrong,of course. But it’s possible to discuss it. Don’t demean yourself and others by starting discussions with disingenuous arguments.
I am not sure abolishing copyright is "wrong," given that copyright developed as a response to a major shift in how written material was disseminated (the invention of the printing press), and that we are now seeing another major shift. A lot of the problems being argued about today, including the issue of paywall circumvention add-ons, have parallels to the historical arguments over printing. Given that copyright replaced a previous system of regulation in response to a new technology, why would we not want to replace copyright with something totally different that is better suited to a technology that has largely replaced printing?
So with copyright being removed, are you okay with companies using GPL code in their proprietary closed sourced software? The GPL is only protected by copyright laws.
So if you are concerned with copyright being removed because you think it will increase the freedom of information, how will that not do just the opposite when companies can take open source code and lock it down?
So in this hypothetical future world, not only will their not be a financial motive for people to create works since anything they create can be freely copied, there will also not be an altruistic motive for people to give back to the community through open source knowing that a for profit company can build on top of the work they did and not give back to the community.
I did not say it would increase freedom of information. I just do not believe copyright is a good fit for the modern world, because it does not really work when copying is not restricted to industrial operations. Today everyone has a copying machine in their pocket or on their desk, and there is no way that applying an industrial regulation to people sitting in their homes using a commonly available tool is going to work.
Keep in mind that copyrights have only existed for about three hundred years. Prior to that there was no notion that authors had a fundamental right to control the distribution of their work, yet people have been writing books (scrolls etc.) for thousands of years. Copyright was a response to what at the time was a relatively new technology, printing. It was not created for the benefit of authors, it was created for the benefit of publishers, who lobbied for the restoration of a monopoly they enjoyed under an earlier censorship law. It is almost a textbook example of regulatory capture.
Instead of allowing new technologies to flourish and new business models for publishers to develop, we are currently trying to emulate the old rules, stifling new ideas (e.g. peer-to-peer systems) and entrenching old business models. It is hard to imagine the sort of technologies we missed out on for the sake of keeping copyrights relevant, or what sort of business models those technologies might have supported. I see a lose-lose in resisting change just because it is inconvenient for some big incumbent industry.
> there will also not be an altruistic motive for people to give back to the community through open source knowing that a for profit company can build on top of the work they did and not give back to the community.
> not only will their not be a financial motive for people to create works
A lot of software is actually commissioned either for private use or to distribute as an app for some business of some sort, which would not be affected by this. Moreover if as you say due to not being a financial motive for people to create non-FOSS software, the chances that someone takes some FOSS software and closes it down will be much lower.
Nevertheless, though unlikely, even if copyright stopped existing it does not mean that there could not be a replacement that only protects FOSS projects.
Plus most FOSS software is being developed by volunteers for free without the resources to fight back.
I don’t know of any reputable company that would take the risk of using open source software in a way that was against its license.
Nevertheless, though unlikely, even if copyright stopped existing it does not mean that there could not be a replacement that only protects FOSS projects.
You really trust lawmakers to have both the will and the knowledge to do that?
That seems to be a personal opinion, stated as fact.
And this complaint is doubly mysterious, because my post above explicitly labels that opinion as an opinion. That’s more than can be said of the vast majority of posts. Including yours.
(Which I don’t fault them for. Whatever disclaimers you may want would seem to just be needless filler)
Yes, but you are missing my point. Link tax is not censorship in and of itself, but it does hinder the sharing of information, the cornerstone of the "information highway".
Removing a plugin, or any tooling for that matter, is akin to censorship, in that it silences a computational action. Someones voice may not have been censored, but their tooling was removed by force by the powers that be.
Yeah, just like you would remove a website from a websites "directory" or better just not display a website that breaks the law or better block it at ISP level! Welcome great firewall! Who said this is censorship?
I would surely hope that salaries are their greatest cost by a large margin, but not sure how it's relevant to my point of it being difficult to emphatize with these publishers who engage in evil practices. Heck, they could just build a static site and host it for free on GitLab.
So we have publishers whose articles can be hosted for free, said articles are likely seen by thousands, sometimes millions, of people, most of which are articles that are mostly copied from other publishers/blogs with little to no research put into it. And we are to believe that this cannot be profitable without pulling this kind of bullshit?
That's sorta like pushing a drowning swimmer down to stop them thrashing around.
I mean... it is going to work. Sort of.
I also feel sorry for the terrible burden that http requests seem to be for you. Meanwhile, large swaths of the richest nations no longer have local news.
God forbid I care about the privacy of those who're technically incapable of protecting themselves from these evil practices.
Edit: as for local publishers, I personally believe they should be government funded and non-profit, but if I had to choose between any publisher (local or otherwise) thriving while violating people's privacy, or not existing at all, then I would surely wish for the latter, and I would hope everyone felt the same way.
So I am allowed to use Developer Tools in any browser and look directly at the HTML, but not use an extension to do the work for me? What is preventing me to View Source for a "paywalled" page?
How is blocking paywalls different from blocking ads? I hope that someone will fork Firefox and remove that code which prevents users from installing any addons.
They were told to not anymore host the extension on AMO, but it's still signed by Mozilla (and I doubt they would stop signing future versions), so you can still download and install the extension from elsewhere.
Also, Mozilla themselves provide a "fork", i.e. builds compiled with the corresponding flag, that allow unsigned extensions to be installed, after you set "xpinstall.signatures.required" in about:config to false. These builds are Firefox Developer Edition and Firefox Nightly, as well as Unbranded Builds [0] for Beta and Stable.
I believe most Linux distributions also compile with this flag, as disallowing unsigned extensions mostly helped against malware on Windows.
That is a very small part. Trying to replace subscription fees with targeted ads was one of the greatest mistakes made by the publishing industry. Paywalls should have been put in place years ago, and journalists should always have focused on writing quality articles that people are willing to pay for instead of clickbait "experiences" meant to drive ad impressions.
Were subscription fees ever the primary revenue source for print newspapers and magazines? I was always under the impression that the majority of their revenue came from ads.
It depends on which newspapers you are talking about, but what I said was that newspapers should not have tried to replace subscription fees with ads, because subscription fees were never trivial and were always needed for serious newspapers to be profitable. There is also the issue of online ads generating far less revenue than their print counterparts, and the fact that newspaper ads include the formerly profitable classifieds section which now has to compete with things like Craigslist.
Maybe it is time we stop relying on a central company to provide our browser software.
Maybe it is time for people to build or configure their own personal browser, so that the authority to install add-ons is a personal choice and not dictated by a company.
If a website has some shitty paywall on their site or article and that can be bypassed, then that site needs to implement something better. Instead what these companies do is make laws that is a cover for their shitty service or lack of good security.
