Brave Talk: Unlimited, private video calls, in browser

I am shocked "8x8 Meet" hasn't been sued by Google yet.

> is also more or less dependent on assuming no malevolence by the certificate authorities

It doesn't have to be. Nothing's stopping you from signing your own certificates, just like nothing is stopping you from trusting the certificate your friend gave you, whether its by printing out the certificate on paper and then "handing" it to you, or sending it in an email. You're also 100% welcome to trust that your friend isn't a moron and lost control of his private key. AT THE SAME TIME, nothing stops you and abunch of your friends from trusting one or 2 dudes to be a certificate authority for your group.

Cryptography wasn't (and never tried to be) ever an alternative to not being stupid. Any 2 people can setup maximum 100% encrypted end-to-end communication using tools older than I am (or about my age). I feel like we let security and centralization blind us to solutions that we already have because those solutions are hard to onboard too. IRC is free, GPG is free, TOR is free, Email is still free.

> the "no malevolence" assumption effectively making any assertions meaningless

I strongly disagree or all assertions in humanity are meaningless. Everything we do and think relies on trusting others.

It's basically impossible to have a trustless E2EE experience if you didn't build it yourself.

> stealing their revenue is not sustainable.

No, that’s not stealing. Yes, it is sustainable (as evidenced by Brave’s ongoing viability as a company).

There used to be a free ISP called NetZero that would give you free dial up if you ran an app that ran at the bottom of your screen and showed ads. I used to adjust the screen so those 100 pixels (or whatever) didn’t show. That wasn’t stealing.

On my hardware, I can do whatever I want with what you send me. If you send me ads, I can choose not to look at them. I can write a program that hides the ads. I can use someone else’s program to hide the ads.

It’s strange that somehow my behavior is “stealing” and that shows a bizarre intellectual outlook on reality, to me.

Am I stealing when I mute ads on broadcast tv?

Am I stealing when I don’t look at billboards on the side of the road?

Am I stealing if I write an AR app that replaces billboards with pictures of kittens? (Or other ads?)

Finally, brave runs great with ads and crypto turned off. So I frequently run it as a “free-loader” and am grateful to the people who watch the ads and use the crypto to keep them in business.

>Give me a browser that is privacy first without crypto/scam bullshit and I am all in.

The Tor browser, not necessarily using onion routing is the option with the least compromises of your privacy.

"Replacing publishers ads with your own and stealing their revenue is not sustainable. Even if you allow them to sign up and claim that revenue."

Tell that to Google.

I think it depends. I think when the material is hard to follow or customer negative and hidden, it’s a dark pattern.

In this case the brave install is a pretty straightforward Yes/No prompt with focus on Yes so people will tap it out of habit.

I think the important factor is the harm in the default action. In this case, it shows ad notifications (pretty annoying) and accrues crypto coins (pretty invisible). I’d be angrier if it consented to sharing all data for whatever purposes they’d like (ie, apps that upload all contacts and photos).

Eh, thanks for calling me out on this. As I reflect a bit more, really what it comes down to is:

- Yes, dev work. I generally always need to be testing against Chromium where FF has such a small userbase that code regressions aren't costly. Keeping two browsers open all the time isn't a big deal, but feels like a hassle for some reason.

- There's a barrier to transitioning away from Google Chrome, but I have to overcome that for either transition. Exporting/importing passwords, hunting down extensions, etc. There's likely replacements for everything on Firefox, but there's absolutely everything on Brave as it's compatible with the Chrome Web Store.

- I don't give bonus points to Firefox for its approach to open source. Yes, it's better to be open source, but compelling, interesting features are where it's at for me.

- I don't give bonus points to Brave for being pro-crypto, but I'm not anti-crypto, either. It does seem like Brave has a faster pace of development these days, and I think it would be more interesting in conversations to discuss that I'm on Brave, and those facts, while relatively trivial, cause me to lean more towards it.

So I suppose it's not so much about staying within the Chromium ecosystem. It's mostly that Brave feels more alive and doesn't have such a bad reputation (IMO) to dissuade me from using it.

Here's a few:

- performance gains from optimized machine code

- CNAME adblocking, which is otherwise not possible on Chromium-based browsers

- robustness against potential changes from upstream (i.e. Manifest v3)

And, not exactly adblocking, but other privacy protections that are only possible with a deep level of control over browser APIs:

- advanced fingerprinting protections, including subtle randomized perturbations of canvas reads, fonts, user agent, etc.

- ephemeral storage sandboxing for third-party content

It works on iOS

DNS based blocking isn't even close to as effective as request level blocking, most Google based tracking is all first party.

I do that, but it is certainly not anywhere near as easy as using Brave.

I am skeptical of Brave, because their business model seems hand-wavy and their crypto shit seems skeezy. But right now, I can't think of anything offering better ROI for ad/tracker blocking.

If you are going to tell your parents "just set up pi-hole on a cheap raspi, or spin up an LXC or Docker container to run it on your LAN, then use it for DNS" then you definitely have different parents than I do.

But pretty much anybody who uses a computer can install and run Brave.

Or just use the browser because not everyone wants to muck with DNS or proxies or any of that.

Using the Diffie-Helman would be good practice, but it's not enough to assume a defence against a malevolent actor who controls the client. It's not about the key exchange itself.

Essentially, a determined malevolent actor who controls the client could exfiltrate your keys easily. Maybe it's intentionally introducing a subtle vulnerability and then exploiting it server-side[0], or it's just simply doing a file upload of the keys. Basically, you can't be certain there isn't a backdoor from a malevolent actor.

[0] IIRC, there was some vulnerability in the Linux Kernel a few years ago that was basically there due to an errant space. Some people theorized that this could have actually been intentionally introduced by sophisticated actors, to hide in plain-sight open source code.

No. The problem with first-party end-to-end encryption is that the entity whose customer you are not just providing the pipe for unknown encrypted traffic, but are also providing the encryption software, and can therefore subvert the encryption software (in order to report the key, or other similar actions) if they decide to act maliciously, or are compelled to by any third party (most likely government). If the software is third-party, then the service provider cannot breach the encryption in any way, or provide any assistance in doing so: the third-party software provider will be the party to attack/require to insert a back door, which in this age will generally be a fair bit harder, though it’s far from inviolable.

I wasn’t aware of this and thought Brave had a good record. Where can I learn more about their mishandling of data and abuse of user trust?

Exactly the opposite happened with me, a few months ago. Brave posts were getting so much mindless hate, and every argument involved shifting goalposts or people just running away when asked specific factual questions in response to their vague FUDding. I was a long term Firefox user who was looking for an additional browser to check out and partially switch to, and this astounding amount of vitriol made me want to check out Brave and see what had these people all riled up.

(And I believe the answer is crypto - any association with it at all. There was a long period when crypto threads were just complete hatefests - yes, even more than today - and I think it's the Moxie web3 article, despite being generally against crypto, shifted the general tone of these to have some actual thoughtful comments. And the Brave thread here seems to have experienced the exact same change compared to before.)

Heh I would not call this breathless praise. There's a minority of posters that like Brave, while the majority either refute the praise or dislike Brave (or both). If you want to dislike Brave go ahead, but at least try to form that opinion a semi-informed basis.

Brave was originally based on Gecko, for what it's worth.

> But isn't this fundamentally better than the current privacy-destroying ad-tracker hellscape we live in?

> even if my ideal world wouldn't involve a middleman that took a 30% cut.

“Knowing where the trap is — that's the first step in evading it.” - Frank Herbert, Dune

Wikipedia is a good example of a verified site that most people use

>Where does the revenue come from?

You can optionally choose to receive ad notifications. Companies pay money to target certain keywords with a notification that links to their website.

Brave buys the BAT they give users from the open market with a percentage of their normal money ad revenue. So there's always someone to sell the tips you get.

Nit: 0% on transactions. You can transact BAT like any other unrestricted ERC20 with no enforced fees (apart from any gas, if applicable). The charge is specifically for donations through their platform.

False. please read https://brave.com/intro-to-brave-ads/

Yes, that’s not a secret but it’s superior to the alternative of sending all of my browser data to an ad service. It’s also completely optional.

I don’t even have Brave installed, but I suspect most people on this site understand how websites can track you no matter how you are routed to them.

Edit: it’s worth reading about privacy preservation, and understanding that users don’t actually need to click the ads (or didn’t used to) in order to get paid: https://brave.com/intro-to-brave-ads/

I'm amazed that you managed to find so much negativity in Brave - a tiny player - making massive accomplishments. Unlike Firefox, Brave does not get half a billion USD of Universal Basic Income from Google every year. They are a for profit entity and need a revenue stream to fund the highly expensive browser development work.

Mozilla is on a nosedive towards fading to obscurity. I am unable to understand any parallels here.

There's a few people here that are repeating a theme that they don't understand Brave's brand. Let me explain what my take on it is.

The CEO has been pivotal in important parts of the internet, he created Javascript and co-founded Mozilla. He seems to be trying to creating a more useful and equitable internet, that's more for users and less for large corporate interests.

All the things I've seen are in support of these goals.

BAT / the ads system he proposed => trying to make the funding for internet sites more balanced for the roles involved, and sustainable both culturally and economically. You can read his thoughts/philosophy on this, he's eloquent and it's informed and interesting - make sure you get it from the source of his own writing instead of the many attacks on him.

The best Adblocking available => not blockable by google, fastest runtime performance. Good for users, less for megacorps.

IPFS => not having much impact now, but aligned with the goal of balancing power away from megacorps towards users.

Calls/Jitsi => again, away from megacorps toward users.

Notice a theme here! That's the brand, however he's not going to sell you on it, hes not spending money doing megacorp 'branding' instead he's quietly making genuinely useful things.

He's actually continuing the mission of what Mozilla was formed to do long ago, before it was overtaken by the G megacorp.

.

n.b. I would say that the theme of rebalancing power away from megacorps towards users probably explains why he gets continual astroturfing, as opposed to the wokeist reasons that are usually stated for it, but thats a different converstation.

I have to agree. Brave's original reason for being was to work on a disruptive new model for media, one that's better for users, producers and advertisers. It looked good on paper, and I think many of us were just glad to see someone try something different. I think the dank cryptocurrency scene was the first thing to seriously undermine its core proposition when it comes to mainstream adoption, so much energy wasted on that BS. As far as I can tell, there was no reason it had to be a blockchain, and all of a sudden you're surrounded by a bunch of losers fluctuating between yelling about the moon and trying to steal their mom's TV set, foaming at the mouth in any case. "I'm gonna go over there", said almost everyone else. So, clearly the attraction to shiny objects was really there from the beginning. Then Search, VPN, "firewall", Playlist (Pocket? On iOS only?), now this. However many years on, core proposition adrift and still no good mainstream browser available.