Slashdot Mirror


Looking Into Mozilla's Financial Success

NewsCloud writes "'Thanks to the Google agreement, the Mozilla Foundation went from revenue of nearly $6 million in 2004 to more than $52 million the next year [similar revenue is expected in 2006]...In 2005, the foundation created a subsidiary, the for-profit Mozilla Corporation,...mainly to deal with the tax and other issues related to the Google contract...By creating a corporation to run the Firefox project, Mozilla was committing to be less transparent. In part, that is because Google insists on the secrecy of "its arrangement and agreements," said board member Mitch Kapor.' The NYT article compares this approach to Wikipedia's ongoing fundraisers and raises the issue of transparency in open source projects. i.e. should Firefox's 1,000 to 2,000 developers and 80,000 evangelists have full knowledge of how revenue is spent as well as the extent to which Google is able to influence strategy vs. other stakeholders."

129 comments

  1. amusing by Red+Flayer · · Score: 4, Funny
    FTA:

    Finally, there is the problem of what Mozilla should do with the money, at least the portion that isn't being reinvested in the Firefox.

    Yes, well, bring that up on the Slashdot if you want some suggestions on where to spend the money. Maybe even ask the Google about it, since that's where the money came from.

    I don't know why use of "the" here amuses me so much, but it makes the author seem very unfamiliar with the companies and products they are writing about.
    --
    "Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
    1. Re:amusing by eln · · Score: 2, Funny

      The correct thing for anyone to do when encountered with a sudden massive increase in wealth is to write a ridiculous article about it. That way, with any luck, the article can go from merely silly to pants-wettingly hilarious when the money goes up in smoke later.

    2. Re:amusing by skam240 · · Score: 1

      I don't know why use of "the" here amuses me so much, but it makes the author seem very unfamiliar with the companies and products they are writing about.

      I thought the author was insinuating that Mozilla was putting its money into the 1980's, Soviet, thought-controlled, mach 6 capable, stealth fighter piloted by Clint Eastwood. http://www.imdb.com/title/tt0083943/plotsummary

      --
      I ignore Anonymous Coward posts. If you want to discuss something, that's awesome. Log in.
    3. Re:amusing by nacturation · · Score: 2, Insightful

      Yes, well, bring that up on the Slashdot if you want some suggestions on where to spend the money. Sure, I'll make a suggestion. $52M spread over 1000 developers means an average compensation of $52,000 per developer -- naturally, scaled based on the relative contributions of each. So some may only make $100 while others may make $1M. Even if you consider their entire 2004 revenue of $6M is taken up by expenses and that it holds true today, that still leaves an average of $48,000 per developer. Shouldn't this be the way contributors to open source get rewarded? Or will they make nothing except for the lucky few who are already on salary and have to offer Firefox support services in order to realize revenue?
      --
      Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
    4. Re:amusing by jez9999 · · Score: 1

      Hmm, from what I can see from that story, ESR got about 150,000 shares in VA Linux when they went public. He said he had about $36,000,000 at the time, when the stock was trading at $239 per share. Yahoo! Finance says it's currently trading at about $4, which leaves him with about 150,000 * 4 = $600,000. Still seems like quite a lot, and that's assuming he *didn't* sell any off preciously, which he probably did.

    5. Re:amusing by iggymanz · · Score: 1

      Firefoxes! That would be some kick-ass promotional vehicles for open source, not like a lame Linux Indi racer.

    6. Re:amusing by hansamurai · · Score: 0, Redundant

      I was going to say the same thing. $600,000 may be more appropriate for the amount of actual work the guy put towards it, but I know nothing about it so I really shouldn't comment specifically on it.

    7. Re:amusing by drseuss9311 · · Score: 1

      but I know nothing about it so I really shouldn't comment specifically on it.
      but you did...
      --
      ------ no thanks... I've quit
  2. I'd like to see more transparancy by Timesprout · · Score: 4, Insightful

    Apparently its ok for Google to chuck cash at Mozilla to default to them, but they dont want the terms of the deal disclosed? Dodgy. Imagine the screaming hissy fits about conspiracy if Microsoft brokered a similar deal with Opera to default to whatever MS call their seach engine these days (yes I know Google got there first as well).

    --
    Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
    What truth?
    There is no dupe
    1. Re:I'd like to see more transparancy by Xybre · · Score: 5, Insightful

      It's hard to see that which is transparent.

      In any case, as much of a paranoid individual I am, I think that Google *has* to be secretive. Google has been targeted by Microsoft, Yahoo, and other huge companies which have a long history of play really really dirty. Google has been around a while now and has no real history of being dirty. Their NDA for interviews which slashdotters freaked about, if they had RTFA and then read the NDA, most of them would have seen the articles took clauses out of context, which you simply can't do, and in context it made sense.

      If I were a rather new, but large, rich company with a lot to lose, I'd be keeping as many secrets as I could from the companies and people who would love to see me fail.

      Know your enemy, and make sure it doesn't know you.

      --
      Eternity is a time bomb.
    2. Re:I'd like to see more transparancy by poadshaw · · Score: 5, Insightful

      I disagree,
      I didn't pay for Firefox. It's a rockin' product, but how does the fact that I use it give me any rights to see what deals the owner's / developers of this F/OSS project have? I think the problem is on the other side. Google is a publicly traded company, so they should have their stock holders asking them the tough questions, not bothering a F/OSS project.

    3. Re:I'd like to see more transparancy by Xtravar · · Score: 2, Interesting

      How has Yahoo played dirty? Just curious... I don't recall anything in particular.

      --
      Buckle your ROFL belt, we're in for some LOLs.
    4. Re:I'd like to see more transparancy by asa · · Score: 5, Informative

      "Apparently its ok for Google to chuck cash at Mozilla to default to them,"

      Actually, we've been defaulting to Google as the default search engine for about 8 years, long before there was a financial relationship.

    5. Re:I'd like to see more transparancy by kels · · Score: 1

      The question is not whether transparency is in Google's interest (they certainly think that it is). The question is whether transparency is in the interest of Mozilla/Firefox, and ultimately of its users.

      --
      "I believe that the cult of the particular brings only death - for it bases order on likeness." St.-Exupery
    6. Re:I'd like to see more transparancy by enjo13 · · Score: 1

      The issue isn't Google, it's the Mozilla foundation. Just as you posit that Google *has* to be secretive, the Mozilla people *have* to be transparent and open. They represent the collective work of thousands of developers, each of home should enjoy 'ownership' in what they ultimately produce. With upwards of $50 million in play, they definitely deserve to know where that money came from and how it's being used.

      --
      Turn s60 photos into awesome videos with mScrapbook for all S60 3rd edition phones!
    7. Re:I'd like to see more transparancy by mpcooke3 · · Score: 1

      Google has been around a while now and has no real history of being dirty

      Well I'm not sure what you mean by dirty but I certainly wouldn't blindly trust a company that produced the Google-Ministry-for-Truth and Google-For-Domain-Squatters projects.

    8. Re:I'd like to see more transparancy by jez9999 · · Score: 1

      Well, quite a few people put time and effort into developing Mozilla products. I'd kinda like to see some of the biggest contributors get paid, as a gesture of goodwill.

    9. Re:I'd like to see more transparancy by Alphager · · Score: 4, Interesting

      It would be good if you had a signature stating that you are Asa Dotzler, Marketing-Guy for Mozilla Inc.

    10. Re:I'd like to see more transparancy by asa · · Score: 4, Informative

      I'm Asa Dotzler, but I'm not really "Marketing Guy", I'm more like "community development guy" who happens to have worked on marketing community (along with qa and testing community, project management community, l10n community, etc. etc.)

    11. Re:I'd like to see more transparancy by watchingeyes · · Score: 1

      Many (most?) companies sign contracts while keeping them secret. I don't see why this is dodgy...

      Anyone who would get mad about Microsoft signing a deal with Opera has too much time on their hands and should focus on more important things.

      --
      http://watching-eyes.blogspot.com/
    12. Re:I'd like to see more transparancy by 75th+Trombone · · Score: 1

      They bought blo.gs, my favorite service, and then promptly ran it into the ground. That's dirty enough for me.

      --
      The United States of America: We do what we must because we can.
    13. Re:I'd like to see more transparancy by Danny+Rathjens · · Score: 1

      Imagine the screaming hissy fits about conspiracy if Microsoft brokered a similar deal with Opera to default to whatever MS call their seach engine these days (yes I know Google got there first as well).
      Apparently the deal fell through. My employer provides blackberries to all and I noticed a couple months ago that the Opera mini search bar changed from google (which it was for 2-ish years at least) to yahoo search.
    14. Re:I'd like to see more transparancy by rtb61 · · Score: 1
      Not really, for the microtrolls amongst us, it is the separation of church and state (crazy OS religionists that they are).

      You have the open source package which is the Firefox code, and you have a separate company which happens to do Firefox coding and distribution, no different to Ubuntu, Redhat or even Novell in terms of Linux. Apart from of course that company got dibs on the name 'Firefox' which strictly literally speaking might not be all that kosher (see another religious reference for all the microtrolls).

      If you want, you can pay the Firefox company to produce a browser for your company with your companies name all over it (as long as you still adhere to the GPL requirements) or you can set up a competing company and distribute your version of the Firefox browser under a different name and market your coding abilities and even, truly no fibs here, make MSN (no '$' in MSN, no money in it) the default search.

      Even M$ can create a version of Firefox and dump IE and distribute it as long as they adhere to the GPL and they can default MSn to their hearts content. So the only real issue is how much should Firefox.com differentiate itself from Firefox.org.

      --
      Chaos - everything, everywhere, everywhen
    15. Re:I'd like to see more transparancy by SenseiLeNoir · · Score: 1

      Asa, a lot of the people commenting here have not had much experience of Mozilla in the early days.

      I was a volunteer of sorts from the day that Netscape announced that they were to release the code. Though I dived into the slightly later released Raptor code (which became NG-Layout/Gecko). I Participated for idealist reasons, I was highly disappointed with the disrespect for established web standards, and felt that having one extremely dominant browser was a detriment overall.

      Although the coding I did was limited between 1999 and very early 2000, after which I switched more to testing, and Advocacy.

      I have seen the "bad times", during the huge rewrite, when all the IT press were dissmissing the Mozilla Project as "too little too late". I was also cheering when in 2002/2003, as the project matured it received more support.

      Having been through the whole project lifecycle, and not a new-comer, I am very aware just how open the development was. Everything was out in the open, including the legendary bitch-fest by JWZ.

      When Google offered that cash, I was probably one of the few who readily felt that it was a good thing. I know the effort put in, and I know the costs. It really hurt when AOL disposed of Netscape. Dont get me wrogn, I really do appreciate AOL for putting in a lot of resources into the Mozilla project, especially at a time, when it wasnt immediately adding to their bottom line. They did release the project at the right time.

      When the Foundation was set free, I was worried, because, Mozilla matters. I was concerned about what would happen when the cash run out. Seeing the "Donate" appear on Mozilla's web site was a real eye opener, because we are building something that needs to be seen by business. Seeing a donate button might scare some businesses away, that are expecting a certain degree of longevity.

      The Google deal gives a sense of credibility.

      As far as I am concerned, Mozilla has created a decent Layout Engine, and work is continuing on that. Sure I have some minor quibbles about FireFox, but FireFox is only one implementation. There are many others.

      I for one, applaud all the folks at Mozilla (everyone, including advocates), persevering at a time when everyone else was dismissing the project; for bringing out a world class browser that actually mattered, and made a big change. A special mark of respect for Mitch Baker who really developed a huge rapport amongst everyone.

      I for one will not even accept ANY "slice of the pie" from participating. I just hope you all spend it wisely and transparently. As for me, I am happy with the karma!

      --
      Have a nice day!
  3. Here We Go.... by mpapet · · Score: 1

    It will be interesting to see how much influence the Mozilla Corporation becomes on the project.

    Given the way money and power corrupt, I'd say there's a fork coming in the next 10 years.

    All hail the IceWeasel! http://en.wikipedia.org/wiki/Iceweasel

    --
    http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
    1. Re:Here We Go.... by speardane · · Score: 5, Insightful
      sorry what is the difference from Sun or IBM or any other big corporation sponsoring developers?

      I expect to get paid, I am not surprised when others do too...

      I don't buy this quasi-religious non-corporate ethos as the best justification for open source - it's better engineering because it gets quality unrestricted peer review

      I want a quality, well engineered genuinely innovative OS - what better justification?

      as long as Google etc... etc... don't suddenly expect to own the code it's great

      --
      if "Faith" could be proved with facts - would it still be faith? So why does "Faith" try to present beliefs as fact? -
    2. Re:Here We Go.... by xappax · · Score: 4, Interesting

      I expect to get paid, I am not surprised when others do too...

      The thousands of volunteers who do much of the actual work on Firefox don't expect to get paid in dollars, but they do expect to be "rewarded" with some kind of involvement and input in their own project.

      This isn't so much about Google giving money to Mozilla as it is about Mozilla obfuscating its processes from its own volunteers. Google is giving giant amounts of money to Mozilla because of the hard work of the Firefox volunteers. I don't think the volunteers expect a dime of that money, or even a vote on how it's spent, but they'd probably at least like to be able to offer suggestions on how to spend it. As it stands, they aren't even allowed to know what's happening to the money, or what kind of agreements were attached to it.

      The obvious response to this complaint is "Well, it's open source; If you don't like it, go fork your own browser!", and I suspect exactly that may happen if Mozilla continues to show this kind of disrespect to the people who are, to a large degree, responsible for the foundation's success.

    3. Re:Here We Go.... by Anonymous Coward · · Score: 0

      You do realize the reason Google is giving so much money to Mozilla Foundation/Corporation is because of that little search bar in the upper right hand corner in every copy of Firefox downloaded, right? Each time someone uses that to search for something, Google gives a bit more money as it's basically advertising. It's not like it's a real big mystery.

      I'm all for this as it means Mozilla will have more money to give to the general programmers who otherwise would be doing work for free. It also encourages more people to help make Firefox better, as who wouldn't rather do a bit of coding for a small bounty?

    4. Re:Here We Go.... by mpapet · · Score: 1

      sorry what is the difference from Sun or IBM or any other big corporation sponsoring developers?

      You are blurring the ways that an IBM or Sun interact with GPL'd projects versus mozilla for the sole purpose of disagreeing with my bias. Please, read on....

      I want a quality, well engineered genuinely innovative OS - what better justification?

      1. That's okay except history is full of organizations where success literally crushes innovation. The specter of failure looms large. So large, no risks are taken.

      2. In this case in particular, the change _required_ for innovation now comes under the control of the for-profit organization.

      --
      http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
    5. Re:Here We Go.... by asa · · Score: 5, Insightful

      "This isn't so much about Google giving money to Mozilla as it is about Mozilla obfuscating its processes from its own volunteers."

      What exactly is Mozilla doing to obfuscate its processes? Is providing a dial-in number to the weekly Mozilla planning meetings some kind of obfuscation? How about dial-in numbers for the Firefox meetings and the Gecko meetings and the Support meetings and the Marketing meetings? Is that also obfuscation? How about the public Mozilla wiki that documents all of the product and project proposals, roadmaps, PRDs, buglists, etc.? More obfuscation? And the newsgroups where all of the planning discussions happen, where all of the tricky technical issues are openly evaluated? And an open bug tracking tool where all of our implementation bugs and patches are publicly discussed, reviewed, and explained? Is that just more obfuscation? How about the annual financial disclosures where the community can see exactly how much revenue Mozilla generated? And the announcements of all of our new hires (many, including project and product leads hired from volunteers in the community) All obfuscated?

    6. Re:Here We Go.... by Anonymous Coward · · Score: 0

      There's a community giving program, through which Mozilla offers hardware and other stuff to the volunteers. They also fund the airline tickets and hotels for their volunteer contributors e.g. wishing to attend events like FOSDEM etc.

      I personally know one of the guys who got a MacBook from them.

      So in fact, at least some of the money goes back to the volunteers.

    7. Re:Here We Go.... by Danny+Rathjens · · Score: 1

      Keeping anything at all secret just gives we coders with no experience in running big companies a bad feeling. Listing all the parts that are not secret is disingenuous and does not do much at all to alleviate that bad taste in our mouths about the part that is. (Especially since you were a bit obnoxious about it.) :)
      I bet a lot of us still have a bad taste in our mouth when our employers tell us to keep our salaries a secret. :) Yes, it's part of the business world, and just "how things work." But I, and I suspect many other like-minded introverted geeks, want everything to be accurate and true.

    8. Re:Here We Go.... by asa · · Score: 1, Insightful

      "Yes, it's part of the business world, and just "how things work."

      We're actually trying to use our leverage to change "how things work" in the business world. A good example would be our "companion" program. We've partnered with several large companies to build customized versions of Firefox that include new and powerful features to compliment their services. Because these partners find value in Firefox and working with Mozilla, we've been able to convince them that the code for their "companion" should be open source and, in cases like the Kodak Companion, that the product have other, competing services (say, Flickr, for example,) built right in.

      We're not going to accept, across the board, that there's "a way" that business works. We're doing what we can, with the leverage we have, to change "how things work". I'd wager, though, that there isn't a single prominent search service that would be willing to disclose the exact terms of a search arrangement and since Mozilla isn't basing the product decisions on the search contracts, but rather the other way around, this is one of those areas where I think we can all accept a bit of opacity.

      (and in case that last part wasn't clear, we don't make Google the default search because they pay us. We made Google the default because defaults are necessary and we felt that Google was the best possible default for our users. If that changes, then the default search engine will change. Google has been the default search for Mozilla going back to like 1999.)

    9. Re:Here We Go.... by Anonymous Coward · · Score: 0

      There is no obfuscation, as you said earlier, Mozilla has been good about it and to date, nobody was worried.

      This is slashdot, and so people make noise about things they don't really care about or even necessarily know anything about.

      You guys are doing great work... and on behalf of all users, please keep it up.

    10. Re:Here We Go.... by Iaughter · · Score: 1

      I'm a professional web developer. I use Firefox and Thunderbird on Windows, OSX, Ubuntu and Solaris. Hear Hear for Mozilla!

      The Mozilla Foundation:
      reinvigorating open web standards
      fighting IE
      multiplatform ...
      showing the world that open source software works!

      Thanks again Mozilla, we love you.

      Isaac Vetter

  4. Interesting double standard of governance by crush · · Score: 4, Interesting

    When you compare the reason that the free SSL certificate providers like CAcert have been kept out of Mozilla's root certificate list (because CAcert can't pay up $250,000 for a bullshit audit from some US accountancy organisation which proves that CAcert won't mismanage funds), and now we have Mozilla doing secret deals with Google (and who knows, they could do them with Microsoft in the future). Mozilla is moving rapidly into the EvilNonOpenCompany territory... but at least the code is all GPLed.

    1. Re:Interesting double standard of governance by kebes · · Score: 4, Interesting

      but at least the code is all GPLed
      (Actually Mozilla products are not released under the GPL but rather their own open-source license.) The fact that it is open-source is the crucial bit, since that's what, ultimately, gives the users the power in this whole situation. And that's why I'm not worried.

      Thus far, Mozilla has done nothing but good things (in my opinion). They have created a nice browser and email client, distributed them as open-source, and have been aggressively promoting their products and FLOSS in general. In short, I trust them... because they have earned that trust with their actions.

      So, with regard to this Google deal, I'm going to give them the benefit of the doubt, and assume that they are making decisions that benefit the community. So far, we have no evidence of anything shady about the deal. (They have disclosed that the money is in exchange for Google being the default, but not the only, engine in the search bar... which is fine in my book.)

      However, I'm not a fool (or at least I like to think so). And if Mozilla is found guilty of shady deals, or "betraying" the community of people who are currently evangelizing and supporting Mozilla, then I will change my stance quickly--as will most others in the community I think. The important point is that because the source-code is available to the community, everyone is empowered to fork the project and ignore Mozilla if that becomes necessary. It would be a shame to loose the Firefox brand, but at least the work that went into the codebase would not be lost.

      It is this "power to the community" that makes me not worry so much... both because it means that if Mozilla becomes "evil" we have an immediate counter-reaction... and also because the existence of this possible counter-reaction makes it rather unlikely for Mozilla to ever turn their back on the community.
    2. Re:Interesting double standard of governance by d3matt · · Score: 5, Informative

      Actualy, Firefox is tri-licensed. So take your pick. If you want to redistribute the code under the GPL, feel free to do so.

      --
      I am d3matt
    3. Re:Interesting double standard of governance by Anonymous Coward · · Score: 0

      Mozilla have been reasonable good guys, but there are a handful of nits where they made unpopular decisions and then closed shop, refusing to even discuss the matter. There's also a general bad smell coming from the HTML5 camp, they appear intent on turning the entire web into tag-soup javascript applications.

    4. Re:Interesting double standard of governance by Anonymous+Psychopath · · Score: 1

      As a CAcert member, I would love for them to be included as a root certificate in all the major browsers, including Firefox. But I understand and agree with the reasons it hasn't happened yet. It's a step above self-signed certificates, but their system does have drawbacks that you should research and understand. I do not consider CAcert sufficient for monetary transactions at this time. They have not yet documented their compliance to accepted security policies and standards. They are working on it, though.

      CAcert is not GPL, they were reluctant to release their source code, and it is reasonable and prudent to require more than to just be a free CA to get your root certificate included in a major web browser.

      Also, you are blaming the wrong party at this point. From CAcert's own WiKi ( http://wiki.cacert.org/wiki/InclusionStatus#head-8 5c7c27aa2c5f493507295453295a15e0132dbc9):

      "Mozilla has established a fair and firm policy which CAcert should be able to meet. Then they threw the ball back to CAcert."

      Don't get me wrong. I _like_ CAcert. I _use_ CAcert. I just don't think my grandmother should implicitly trust them, yet.

      --

      Eagles may soar, but weasels don't get sucked into jet engines.

    5. Re:Interesting double standard of governance by gkhan1 · · Score: 1

      You're actually wrong there, Mozilla Products (Firefox, at least), are triple-licensed using the MPL, GPL and LGPL. Originally, they were only licensed using the MPL, but they went to some trouble to add the GPL and LGPL. See their relicensing FAQ

    6. Re:Interesting double standard of governance by crush · · Score: 1

      CAcert were blocked for IIRC 2 years while they waited for Mozilla to draw up guidelines about which root certificates would be included. They included and still include root certificates from Thawte/Verisign (which have been proven to have a lower standard than CAcert (no Web of Trust model) which led to them issuing Class3 developer certificates for Microsoft to an outside party. Mozilla included those garbage certificates and then spent 2 years drawing up the ladder. CAcert will NOT be included until they can meet the requirements of the Certified Institute of Public Accounts which will cost them US$250,000 for an audit. It is true that CAcert needs to get their act together too and is doing that (in terms of their board structure), but there's no question that different standards were applied to them, they were delayed for a shockingly long time, and one of the necessary criteria is US$250,000. To me that's different standards being applied, with Mozilla leaning strongly in favour of those that have money. As for "trusting implicitly", no one should trust any certificates implicitly and CAcert's WoT offers a superior model to agreeing to trust a certificate issued by Verisign/Thawte (who will take any crappy old photocopy of a driver's ID and fling out a certificate as long as you give them US$25).

    7. Re:Interesting double standard of governance by quentin_quayle · · Score: 2, Interesting

      "Thus far, Mozilla has done nothing but good things (in my opinion). ... I trust them... because they have earned that trust with their actions. ... So, with regard to this Google deal, I'm going to give them the benefit of the doubt, and assume that they are making decisions that benefit the community. So far, we have no evidence of anything shady about the deal."

      I disagree. There is plenty that is shady in Mozilla and it's increasing.

      Basically, there is a force within the Mozilla Foundation that's dedicated to selling out the users to data-mining, and a counterforce of devs and users who are still idealistic. This conflict appears occasionally in debates about particular features, and more importantly in the browser's evolving features.

      I don't have the relevant links handy here at work but I'll recount some of this from memory.

      * They disabled first the image confirmation feature (whether to accept images from particular sites), and then removed the ability to easily find out image urls without leaving the page.

      * They added support for the "ping" attribute in links, which notifies a server other than the link destination when the user clicks the link - and defended it with the nonsensical argument "you may hate this, but sites will do it anyway by other means, therefore it's better to make it easy for them". It would have been on by default if not for protests.

      * Prefetching feature (applied to top results in Google searches for example) makes network requests without user notification or initiation, and it would have been on by default if not for protests.

      * "Live bookmarks" feature in FF2 makes network requests without the user requesting them.

      * In FF2, RSS icons are requested without notification or consent from users.

      * Firefox 2 retrieves a page from the remote server whenever the user makes a bookmark; there is no notice to the user about this, and there's no way to turn it off.

      * Anti-phishing feature in FF2 has optional feature to send every URL visited to Google.

      * Something in Firefox 2 makes a network request at startup, even if home page is blank, all auto-updates are turned off, anti-phishing feature is off, etc.. This is reported in a thread on Mozillazine and I've personally confirmed it. It is still unexplained by M.F oundation.

      The point is that this trend is increasing fast. I have no choice but to conclude that Firefox users have been sold out in the secret deal.

    8. Re:Interesting double standard of governance by Lord+Ender · · Score: 1

      CAcert? They are free? What is their financial incentive to undergo the heavy security investment required to keep their root private key secure?

      How much money do they spend, per cert, verifying that the certs they issue are to legitimate businesses and not to phishing scams?

      What does CAcert have to lose if they make a serious mistake, such as issuing a major bank certificate to a scammer?

      With free SSL certificates, is there any sort of money trail to follow to hunt down and prosecute criminals who abuse the system?

      Free SSL certs sound great it principle, but not so great in practice...

      --
      A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
    9. Re:Interesting double standard of governance by maxume · · Score: 1

      Half the things you listed are things that it doesn't do.

      --
      Nerd rage is the funniest rage.
    10. Re:Interesting double standard of governance by Achromatic1978 · · Score: 1

      What does CAcert have to lose if they make a serious mistake, such as issuing a major bank certificate to a scammer?

      Pretty much the same as when Verisign/Thawte issued a certificate for "Microsoft Corp." to a malware provider, allowing them to sign their code as Microsoft?

      In other words, "not a fucking thing".

    11. Re:Interesting double standard of governance by Gerv · · Score: 1

      So it's not necessary to have any independent confirmation that a CA (who, after all, ends up being trusted by every user of the software) actually has some level of competence? So you'd add FreeFreeFreeCerts (https://bugzilla.mozilla.org/show_bug.cgi?id=2334 58 - Slashdot referers disabled in Bugzilla) to the root store?

    12. Re:Interesting double standard of governance by Gerv · · Score: 1

      CAcert were blocked for IIRC 2 years while they waited for Mozilla to draw up guidelines about which root certificates would be included.

      Along with every other CA. The backlog is only now being cleared.

      They included and still include root certificates from Thawte/Verisign (which have been proven to have a lower standard than CAcert (no Web of Trust model) which led to them issuing Class3 developer certificates for Microsoft to an outside party.
      Are you arguing that the web would become a more secure place if those certificates were removed? Teaching users to ignore security warning popups on 50% of secure websites doesn't seem to me like a good way to improve security. Also, are you willing to be held to the same standard? If CACert was included, and then issued a single certificate incorrectly, would you be happy for your root to be removed for ever more?

      CAcert will NOT be included until they can meet the requirements of the Certified Institute of Public Accounts which will cost them US$250,000 for an audit.
      There are several different sets of audit criteria which are acceptable, with AICPA WebTrust being only one of them.

      To me that's different standards being applied, with Mozilla leaning strongly in favour of those that have money.
      Actually no, it's you who are arguing that different standards should be applied to those who don't have money.
    13. Re:Interesting double standard of governance by crush · · Score: 1

      Don't get the idea that I speak for CAcert. I'm just someone that wants to use free SSL certificates and am pissed off that every time I go to use them I have to explain to clients about how to import the CAcert root and try to explain why Mozilla/Firefox doesn't see fit to include this perfectly good certificate.

      Actually no, it's you who are arguing that different standards should be applied to those who don't have money.

      Actually no, I'm arguing that the standards that you claim to apply have only one criterion which CAcert fails to meet: money

      I'm also arguing that the other standards that you claim to apply are pretty bloody low anyway as evidenced by the fact that Thawte/Verisign have a rich history of bungling and issuing certificates which they shouldn't have.

      Are you arguing that the web would become a more secure place if those certificates were removed? Teaching users to ignore security warning popups on 50% of secure websites doesn't seem to me like a good way to improve security.

      Teaching users that certificates issued for money (Thawte) meet a higher standard (good enough to be in Firefox root cert store) than certificates issued for free (CAcert) seems like a WORSE way to me. It may not have been Mozilla's intent, but that's what you've done. You've helped to foster the impression that a company that has an incentive to issue as many certificates in as little time as possible (because it's paid per cert) is a safer bet than an organisation that issues certificates for free. Congratulations, you've just added your own confusion to the wonderful world of security.

    14. Re:Interesting double standard of governance by crush · · Score: 1

      Your only distinguishing measure of competence at this stage is $US250,000.

    15. Re:Interesting double standard of governance by Gerv · · Score: 1

      You think CACert, as it is now, would pass a WebTrust audit if it had the money? Really?

    16. Re:Interesting double standard of governance by Gerv · · Score: 1

      try to explain why Mozilla/Firefox doesn't see fit to include this perfectly good certificate.

      So you can prove that, through its long and varied life under various project leaders, the CACert root key has never been leaked, compromised, or given to someone who now has a grudge against the project?

      Actually no, I'm arguing that the standards that you claim to apply have only one criterion which CAcert fails to meet: money

      No. The standard is a passed audit - i.e. a 3rd party assessment of competence. Yes, this costs money, because it takes time. It would always cost someone money. If we did it ourselves, it would cost us money instead of the prospective CA. The only alternative is taking anyone's word for it when they say "I'm competent". Not, perhaps, the best security decision.

      Teaching users that certificates issued for money (Thawte) meet a higher standard (good enough to be in Firefox root cert store) than certificates issued for free (CAcert) seems like a WORSE way to me.

      If Thawte gave away certificates for free tomorrow (and, in fact, several CAs in the store give away certain types of certificate for free) then they would still be in the store, and CACert would not. If CACert decided to start charging $100 per cert tomorrow, they would still be out. It's not about how much the CA charges for the certs.

      You've helped to foster the impression that a company that has an incentive to issue as many certificates in as little time as possible (because it's paid per cert) is a safer bet than an organisation that issues certificates for free.

      ...and has absolutely nothing to lose if they issue a duff cert. The entire CACert team can walk away tomorrow, saying "Hey, we tried. Never mind. Beer, anyone? Shame about Firefox's reputation for security, eh?". That's not something which inspires confidence.

    17. Re:Interesting double standard of governance by crush · · Score: 1

      So you can prove that, through its long and varied life under various project leaders, the CACert root key has never been leaked, compromised, or given to someone who now has a grudge against the project?

      And you can prove that about Thawte/Verisign? No, all you can prove is that they paid a lot of money to some a group of self-declared accountants with expertise in security -- and that the high-standards enforced by these people led to at least one public instance of a severe social-engineering attack. (And just as an exercise for you, try and get a cert out of Thawte/Verisign with bogus credentials. It's doable, believe me.

      Actually no, I'm arguing that the standards that you claim to apply have only one criterion which CAcert fails to meet: money No. The standard is a passed audit - i.e. a 3rd party assessment of competence. Yes, this costs money, because it takes time. It would always cost someone money. If we did it ourselves, it would cost us money instead of the prospective CA. The only alternative is taking anyone's word for it when they say "I'm competent". Not, perhaps, the best security decision.

      An audit which is of very doubtful value given all the evidence about certificate authorities whom you accept as having passed such audits.

      If Thawte gave away certificates for free tomorrow (and, in fact, several CAs in the store give away certain types of certificate for free) then they would still be in the store, and CACert would not. If CACert decided to start charging $100 per cert tomorrow, they would still be out. It's not about how much the CA charges for the certs.

      Not directly no, but indirectly it is. CAcert can't raise the money for the audit because they don't charge money.

      ...and has absolutely nothing to lose if they issue a duff cert. The entire CACert team can walk away tomorrow, saying "Hey, we tried. Never mind. Beer, anyone? Shame about Firefox's reputation for security, eh?".

      And so now you come full circle to contradicting yourself and accepting that what you trust is wealth and the threat of losing that wealth.

      That's not something which inspires confidence.

      And the practices of the major certificate issuers does? You've just taken an awful lot of responsibility on your shoulders.

      The Mozilla Foundation has only one credible course left open to it: sponsor your own certificate authority, preferably by creating a massive WoT. Otherwise this is just a sham. Which we both know it is really.

    18. Re:Interesting double standard of governance by Gerv · · Score: 1
      You continue to bang on about the one example mistake everyone brings up about Verisign (which, I have no doubt, caused serious internal reviews and changes of procedure inside that organisation). It's interesting that everyone uses that example - because, despite all the procedural flaws etc. CACert activists claim the current model has, it's the only example there is, after millions of certificates have been issued. But you still don't answer my key question: are you willing for CACert to be held to the same standard you are holding Verisign to? One mistake and you're out?

      And so now you come full circle to contradicting yourself and accepting that what you trust is wealth and the threat of losing that wealth.

      No - what I trust is having some skin in the game. If Verisign start issuing dodgy certs, their business collapses, everyone loses their jobs and they are on the dole queue. And the employees or management probably get sued into oblivion by the shareholders. That's a fairly powerful incentive to do the right thing. Where's the incentive with CACert? If, for example, the CACert crew were willing to put up a $1,000,000 bond against fraudulent issue (which all the EV cert-issuing CAs are doing) then that would be some skin in the game.
    19. Re:Interesting double standard of governance by crush · · Score: 1

      But you still don't answer my key question: are you willing for CACert to be held to the same standard you are holding Verisign to? One mistake and you're out?

      But that's not what I've suggested. You're operating on a very simplistic binary model of "trust". Mozilla's list of (you can trust these guys absolutely) certificates creates the wrong impression: especially when you make it hard for CAcert to get included in that list. Wow! CAcert must have done something worse than handing out Microsoft Class 3 developer certificates ... and other bogus certificates that I and others can attest to personally.

      So the question is, "what exactly are the standards to which Mozilla/Firefox are holding CAcert and Verisign which exclude on and include the other?" The answer it seems is that Thawte/Verisign got in early, have a proven track record (which you like to try and ignore) of untrustworthiness and after that you started a TWO YEAR LONG PROCESS of deciding what the standards were as soon as free cert groups appeared.

      Me:And so now you come full circle to contradicting yourself and accepting that what you trust is wealth and the threat of losing that wealth.
      You:No - what I trust is having some skin in the game. [snip] If, for example, the CACert crew were willing to put up a $1,000,000 bond against fraudulent issue (which all the EV cert-issuing CAs are doing) then that would be some skin in the game.

      Ehh... so to repeat "what you trust is wealth and the threat of losing that wealth".

      As for EV, more snake oil, but this time it has been demonstrated to be so before it's widespread. Firefox adoption of that is another indication that you've given up on serious security.

    20. Re:Interesting double standard of governance by Gerv · · Score: 1
      I don't deny that the appearance of CACert (among other things) led us to develop guidelines. I don't think that's unreasonable, given that the differences between CACert and other CAs. The fact that it took a long time is unfortunate, but these things happen in a volunteer project. Unless you think there is personal animosity between Mozilla people and CACert people, or you have conspiracy theories about backhanders from established CAs, then you must accept that our actions were motivated by the desire to provide a most secure browsing experience for our users.

      Mozilla's list of (you can trust these guys absolutely) certificates creates the wrong impression: especially when you make it hard for CAcert to get included in that list. Wow! CAcert must have done something worse than handing out Microsoft Class 3 developer certificates ... and other bogus certificates that I and others can attest to personally.

      So your model would be that we rank all CAs in order of evilness (in our eyes) and include only those that meet some lack-of-evilness benchmark that we set?

      The answer it seems is that Thawte/Verisign got in early, have a proven track record (which you like to try and ignore) of untrustworthiness

      So what would a proven track record of trustworthiness look like? Are we back to demands for perfection?

      Ehh... so to repeat "what you trust is wealth and the threat of losing that wealth".

      If you want to characterise it that way. Why is this bad?
    21. Re:Interesting double standard of governance by crush · · Score: 1

      Unless you think there is personal animosity between Mozilla people and CACert people, or you have conspiracy theories about backhanders from established CAs, then you must accept that our actions were motivated by the desire to provide a most secure browsing experience for our users.

      I'm so far out of the loop that I have no idea about personal animosities or backhanders. You've got two minor bugfixes from me, so I have no knowledge of what really goes on or who's who. What I DO know is that Mozilla is not taking a lead in security:

      • 1. The Mozilla Corp is rolling in money (so much so that according to the article it is looking for someone to manage spending it)
      • 2. The details of your deals are secret
      • 3. You see no problem with occupying a gatekeeper position for root certificate lists which operate on a binary model of trust
      • 4. You have denied strenuously that the central criterion in your trust model is how much money there is to lose and now admitted it
      • 5. You are glossing over the large problems exposed by for-profit certificates (Thawte/Verisign's most popularized breach occured AFTER they had obtained the Chartified Security Account Experts Who Sell US$250K Certs marque of approval

      You know all this, I know all this. You've been dancing around like a madman trying to deny that what you're convinced by is money and that that's the reason that you trust Thawte/Verisign and not CAcert.

      Even if CAcert (or anyone else) were to scoop up the $250,000 (perhaps in donations from the now lush with cash Mozilla Foundation) and meet that criterion for inclusion on the list, there would STILL BE A PROBLEM with having Thawte/Verisign there.

      And you'd still be peddling the idea that certificates mean more than they do, and that free certs are less trustworthy. What you're engaged in is fabricating a set of Emperor's Clothes while scoffing at the other nudists.

      So your model would be that we rank all CAs in order of evilness (in our eyes) and include only those that meet some lack-of-evilness benchmark that we set?

      You mean like how much money they have?

      How about ranking them in order of trust assigned to them by a reticulated network of other certificate users? Oh, wait, they wouldn't be paid for doing that so it can't be real in your eyes.

      So what would a proven track record of trustworthiness look like? Are we back to demands for perfection?

      All you can show is that a person was scrutinised by some other people and had certain government documents and used the proof of that scrutiny to register a domain. That's it. Any other implications of "proven trackrecords of trustworthiness" or "having some skin to lose" are only implications, mirages. The very fact that you're considering that certificates show "trustworthiness" as opposed to "a reasonably strong probability that lots of humans would have to be tricked to believe this identity" is disturbing.

      So, for example, I don't complete disbelieve the identity of a site presenting a certificate just because it's a Thawte/Verisign certificate. I realize that /probably/ it's OK, but I might do a little more diligence if I'm exchanging interesting information with it. Under your model, and it's the model with which you are miseducating other net users I ought not to waste my time doing this because according to you BankX has a "proven trackrecord of trustworthiness" as verified by AIPCA.

      Similarly, I ought not to trust the CAcert presenting site (even though the presenter went through between 4 to 5 scrutinies by separate assurers who have no personal gain in issuing the certificate.

      Me: Ehh... so to repeat "what you trust is wealth and the threat of losing that wealth".
      You (finally): If you want to characterise it that way. Why is this bad?

      Because of the two effects that that has: 1) it makes it artificially hard to "get on the list" thus

    22. Re:Interesting double standard of governance by Gerv · · Score: 1

      I think we're probably both done with this topic.

      If you like. FWIW, I think your message takes no account whatsoever of the prevailing reality, which is that "rankings according to a reticulated network of other certificate users" are a non-starter for web browser-based trust models. What users want to know is "can I put my credit card in this box"; we are attempting, with the tools we have at our disposal, to help them make that decision. Hence, in large part, EV - the contents of a certificate need to be trustworthy before you can make a decision based on it.

      Your post is also full of loaded words - what you call a "gatekeeper position", I call "taking responsibility for the security of our users" and "not just trusting any old Joe who asks". What you call "peddling", I call "believing". And so on. Hardly a way to construct a convincing argument.

      And you'd still be peddling the idea that certificates mean more than they do, and that free certs are less trustworthy. What you're engaged in is fabricating a set of Emperor's Clothes while scoffing at the other nudists.

      So CACert and Verisign are both nudists, then?

      Free certs are, all other things being equal, less trustworthy because verifying someone's identity takes time and money, and taking responsibility for that verification requires indemnification (i.e. insurance, or a large pile of cash). That time and money has to come from somewhere. It can either be obvious where it comes from (in the commercial CA model), or it can be less obvious. Or the verification can be done badly or not at all.

      You, in contrast, are "peddling" the idea that just because CACert's web of trust model is better, that means we should trust them as an organisation. And that's rubbish. Their organisational woes are well documented.

      The very fact that you're considering that certificates show "trustworthiness" as opposed to "a reasonably strong probability that lots of humans would have to be tricked to believe this identity" is disturbing.

      Now I know you're just ranting, because trustworthiness was your word, not mine, and we were discussing CAs, not end users.
  5. Murky by Recovering+Hater · · Score: 1

    It's not so much that the Mozilla Corporation continues to paddle around in the murky waters as it's more about how *content* the Mozilla Corporation is to be in murky waters.

    --
    My humor is probably your flamebait
  6. Google's new Motto by Anonymous Coward · · Score: 2, Funny

    Do slightly less evil than Microsoft

  7. scale by stoolpigeon · · Score: 2, Informative

    we are used to looking at systems and asking, 'will it scale?'
     
    when you look at the products that do scale- or implement something at a very large scale, it takes money. i've not seen an exception yet. i don't care about firefox, google and their deal - as long as the browser works the way i want.
     
    on a side note-- as for what to do with the 'extra' money. i'd love to see it invested in making other open apps - like sunbird and thunderbird great.

    --
    It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
  8. Google deal a slippery slope by traindirector · · Score: 4, Insightful

    Any time a project gets big and starts bringing in money, it gives up a certain amount of control that each person who works on it previously had. When I heard they were making a for-profit corporation to make secretive deals with massive corporations like Google, I initially thought things were worse than they are. But there's no question that there's a slippery slope in this deal where an open-source project that was previously fueled by the interest of developers could become entrenched and weighed down by the monetary and business aspects in the politics of a company.

    The best way to keep things open and developers interested is to release all the information except that which Google requires be kept secret. It's already pretty clear the type of revenue that is coming from the Google. When things get this large, it's easy for those interested in developing to fall out of touch with something that resembles Microsoft a lot more than a community undertaking.

    1. Re:Google deal a slippery slope by monk.e.boy · · Score: 3, Insightful

      Tricky isn't it? We all want Firefox (and open standards) to beat Flash, Sliverlight etc. to beat coporate lock in.

      But is that open standards browser now a corporate lock in?

      But, but... "do no evil"... we can trust google?

      I say take their money, buy some good developers, then run ;-)

      monk.e.boy

    2. Re:Google deal a slippery slope by asa · · Score: 2, Informative

      "The best way to keep things open and developers interested is to release all the information except that which Google requires be kept secret."

      We did this for both 2004 and 2005 and will be doing it for the 2006 year financials (and then 2007 after that.) There is nothing secret here except the specific financial details that Google will not allow to be disclosed. It's not that hard to look at the Mozilla financials, read the statements from Mozilla explaining that the overwhelming majority of Mozilla's revenue comes from search relationships and that the bulk of the search revenue comes from the default search service.

    3. Re:Google deal a slippery slope by asa · · Score: 2, Informative

      "But is that open standards browser now a corporate lock in? But, but... "do no evil"... we can trust google?"

      What corporate lock-in? We've been providing built in search in Mozilla applications for the better part of a decade. We have always provided multiple search services and an easy mechanism for adding additional services (there are about 12,000 alternative search services here: http://mycroft.mozdev.org/ )

      You don't have to trust Google. You can decide whether or not you trust Mozilla to pick reasonable defaults based on what users want, or you can not trust Mozilla to pick reasonable defaults based on what users what.

  9. Know what they should do with that revenue? by Elsan · · Score: 1, Informative

    They should give it to me. That'd be fair for everyone involved.

  10. Open it up, who cares if Google wants secrecy by Concern · · Score: 1

    That's a lot of money. I hope the developers who did all the work don't come to feel taken advantage of through the maneuverings of these foundations and corporations. Transparency is the only way I know to handle this kind of thing.

    What's the point of the secrecy in the google deal anyway?

    How about Mozilla opens the kimono? If Google likes secrecy more than the deal itself, I'm sure that MSN or Yahoo or another competitor will be happy to take their place...

    --
    Tired of Political Trolls? Opt Out!
  11. And this is surprising because? by xxxJonBoyxxx · · Score: 1
    And this is surprising because? It should be no surprise that the same people churning out PR about "Web OS" vaporware (Mozilla) are financed by the company that would stand to gain the most with a "Web OS" (Google).

    i.e. should Firefox's 1,000 to 2,000 developers and 80,000 evangelists have full knowledge of how revenue is spent


    Hmmm...a couple hundred/thousand contributors in the dark and a $52M bullseye. I'm not a lawyer, but if I was I'd probably be busy trolling for anyone wanting to class-action -itize their favorite complaint.
  12. Whom should be considered the forker? by Nymz · · Score: 1

    If the Mozilla Foundation goes down a path of secret agreements, proprietary code, and strings-attached Google sponsorship, then wouldn't the original contibutors that want to continue on with the original project goals be considered forkers? Iceweasal anyone

    1. Re:Whom should be considered the forker? by R2.0 · · Score: 3, Funny

      Did anyone else read that as
      "a path of secret agreements, proprietary code, and G-strings attached sponsorship"?

      Anyone?

      (Man, I need to get laid more often)

      --
      "As God is my witness, I thought turkeys could fly." A. Carlson
  13. I'm glad by joe+155 · · Score: 4, Interesting

    I'm happy Mozilla is making a nice amount of money, that's really the point we are trying to make with the GPL isn't it? you can still be commercially viable and open source - don't fear it...

    I would also say that there is no danger for the community, it'd be really easy to fork it if things really got that bad... hell, we already have Ice Weasel...

    --
    *''I can't believe it's not a hyperlink.''
  14. They don't need influence by Alternate+Interior · · Score: 1

    No, Mozilla's developers and evangelists should not have more control over the ways money is spent. People who live lower on the totem pole often do not understand the true costs and requirements of doing business. 2000 developers arguing over the neccessity of spending a few hundred dollars will do no good for the overall project.

    Some will claim that only a small percentage of the overall developer base will be interested in it, but this is still an invalid position. If they want to participate in those kinds of positions, they need to adopt a second position within the corporation. Just being a developer is not good enough. At your job, working on your company's web site does not entitle you to dictate marketing dollars use to the CEO. You're still free to offer advice in either scenario, but advice need not be acted upon.

    As for the evangelists and financial contributors: If they do not like what they see happening, they are free to cease contribution.

    The point is that although Firefox is an open-source project, conflict of interest and incompotence still exist, and the corporate structure helps to mitigate it. Let the business people do what they do best, and the developers do what they do best. If software development positions within Mozilla were available, people would be clamoring for such a clearly-split division of responsibility. Although developers here are not paid resources of Mozilla the corporation, nothing changes. And if you don't like that, you can always fork the code into yet another design-and-management by the community open-source project that nobody uses.

    1. Re:They don't need influence by xappax · · Score: 0, Troll

      conflict of interest and incompotence still exist, and the corporate structure helps to mitigate it.

      lol.

    2. Re:They don't need influence by Alternate+Interior · · Score: 1

      Yes, it does sound ironic. But in a corporation, anyone can be silenced, and relatively easily. Given a compotent and confident base, it can be maintained.

    3. Re:They don't need influence by gregwbrooks · · Score: 1
      I hate to sound like a pure fanboy, but I thought this was one of the most reasonable posts in the whole thread.

      The fact is, if they're taking in that much income then they chose a wise strategy - one of several possible ones - for dealing with the tax implications. The IRS doesn't like nonprofits that take in ever-larger piles of cash without (somewhat) commensurate outlays, so this is a cash-management strategy as much as anything. Could the foundation start donating wildly to other open-source projects? Could they figure out a way to reimburse developers? Could they turn the money into an investment fund that would earn returns funding the project far into the future. Yes, they could do any of that and much more.

      But the thing is, all of that takes time. This is a lot of cash in a relatively short amount of time; the activity that's been undertaken deals with some tax issues without walling off any options in the future.

      What about the developers? Shouldn't they have a say in what happens to that money? I'm not a licensing expert (Slashdot is full of 'em - someone chime in), but it seems like a logical fallacy for folks to think that a license allowing free and easy forking would also, implicitly, offer contributory rights of future renumeration or use restriction. It seems like it would be very hard to have both.

      The history of open source software is full of good products that forked into great products; if enough developers don't like what's going on, then this may be a case of a great product forking into a phenomenal product. But I frankly don't think that will happen because the brain trust at the foundation (and now, corporation) hasn't made too many mis-steps so far.

      --


      "It was a summer's tale: Just a boy, his Linux, and a head full of dreams..."
  15. Well.... by InfiniteSingularity · · Score: 2, Funny

    Do slightly less evil than Microsoft

    Aren't we all?

  16. Opera is not an open source project. by traindirector · · Score: 3, Insightful

    Imagine the screaming hissy fits about conspiracy if Microsoft brokered a similar deal with Opera to default to whatever MS call their seach [sic] engine

    I can't imagine the screaming hissy fits if Microsoft made this type of deal with Opera. I doubt there would be any. Opera has no more responsibility to its developers than any other for-profit corporation. And they're free to follow money wherever it may lead.

    Mozilla deals are different because the Mozilla non-profit organization is a representation of the community that develops Gecko and the projects they base on it. When a for-profit company is founded with an ambiguous relationship with the original organization, the role of the development community comes into question. Sure, they're still be contributing to GPL code, but will the spirit of the project still inspire such developer devotion, with so much non-paid contribution? Could they?

    1. Re:Opera is not an open source project. by asa · · Score: 3, Insightful

      "When a for-profit company is founded with an ambiguous relationship with the original organization, the role of the development community comes into question."

      What exactly is ambiguous about this relationship. Mozilla has been building search into the browser for about 8 years now. Google has been the default for almost as long. Google, along with other search companies, recently (a couple of years ago) started paying Mozilla for this feature. Mozilla discloses its full financials each year. Mozilla has said, repeatedly, that the bulk of revenue comes from search partners and that the majority of search revenue comes from (obviously) the default search service. Where's the ambiguity?

    2. Re:Opera is not an open source project. by Michael+Wardle · · Score: 1

      There was some outcry when Opera recently decided to change its builtin search engine for its mobile browsers from Google to Yahoo.

  17. More social networking features... by xENoLocO · · Score: 1

    They should spend the money to develop the social networking features that their userbase is begging for. Then, they should integrate a calendar and mail client, and only make it available as one big download.

    They could call it... Mozilla Navigator...

    No, but seriously. How about paying some major contributing developers, and maybe hire some on full time to develop better web standards support, instead of fucking around with features like social networking and offline browsing. Features that are way out o the scope that made Firefox popular to begin with. They need to continue to look at themselves as losing. They need to strike deals with PC manufacturers like Dell to become the default browser on new systems, etc.

    "When people succeed, they tend to party. When people fail, they tend to ponder." -- Tony Robbins

    Mozilla needs to be pondering, regardless of what their bank account looks like.

    --
    "The need to build the internet comes from something inside us, something programmed... something we can't resist."
    1. Re:More social networking features... by HooptieJ · · Score: 1

      They could call it... Mozilla Navigator... Ummm... it was called navigator, then Mozilla Suite, now its SeaMonkey http://www.mozilla.org/projects/seamonkey/ I still have Firefox and Thunderbird , and sunbird installed. but long ago SeaMonkey replaced them in day-to day use. Its a Few version Numbers behind Ffx and T-Bird, but the plugins all work (including the Sunbird calender plug-in), and its day-to day reliable. Just like the old Netscape Package, it has: A Browser "Navigator"(ffx core) EMail "Mail & Newsgroups"(T-Bird), You can install the SunBird Plug-in(Calender), has a shared Address Book, It has "Composer" which is a nice simple Html builder (With Firefox preview built in). Itupdates more often than firefox (since they're behind i guess?) but all in all its F'n awesome. When I need to toss a fast table w/ pictures and captions onto my blog or work pages, Composer does the job admirably. And since its just a plug-in , its MUCH faster then hauling out DreamweaverMX for simple things. Hoop
    2. Re:More social networking features... by xENoLocO · · Score: 1

      I was being sarcastic... ;)

      --
      "The need to build the internet comes from something inside us, something programmed... something we can't resist."
    3. Re:More social networking features... by hyc · · Score: 1

      Actually Sunbird is the standalone calendar app. Support for the Suite's Calendar Extension was officially dropped a long time ago. I've put together a working build of it (http://highlandsun.com/hyc/mozilla/) but there's no official recognition of any of my work by either the Calendar or the Seamonkey teams. (And obviously, since I still use the Calendar Extension every day, I think it's a useful item that should never have been dropped. But hey, I'm just one of the thousands of volunteer Mozilla developers with no say in anything. Strange that there's thousands of developers but not enough manpower to maintain a few extra build rules. Life is short, where does all the time go...)

      --
      -- *My* journal is more interesting than *yours*...
  18. nono no! by kitsunewarlock · · Score: 0

    The author of this story is all wrong! Firefox is a FREE product. Mozilla can't make money off free product. STORY FALSE!

    +5 Insightful!

    --
    Ginga no Rekshiya Mata Each page.
  19. what's the problem? by Anonymous Coward · · Score: 0

    Remember microsoft killing netscape because of no revenue from the browser? I'm happy Google is doing this. Firefox is enough of the market that m$ can't force people to use IE only. People have to code to standards.

    Get over it.

  20. is there a department of manageing this project? by ClassFoo · · Score: 1

    is there a department of manageing this project? if there is one, so it should try to spend these money on making firefox better software and spreading firefox to more people. otherwise, they should make this transparently, any way, it's not import where these money came from, but where this money will be spend on

  21. sometimes they just make shit up by asa · · Score: 2, Insightful

    "By creating a corporation to run the Firefox project, Mozilla was committing to be less transparent."

    And this follow from what? There is nothing about the existence of the Mozilla Corporation that commits us to being less transparent. That's just bunk and it makes no sense given how transparent we are from our development process and planning to our financials.

    As far as the details of specific financial relationships with search partners, those were never disclosed in detail (long before the creation of the Mozilla Corporation, in Mozilla Foundation days) and probably won't be since our various partners weren't then aren't now willing to divulge the specifics of their financial relationships with anyone. Mozilla is as transparent as we can be around those relationships, releasing our annual financials and explaining that the bulk of it comes from relationships with various search partners including our default search, Google.

    The article overall is fine, but that line is just fiction.

  22. One source of income they don't talk about... by bigbigbison · · Score: 5, Interesting

    From the search box in firefox do a search on Amazon. Look at the url. See that, "mozilla-20" in the url? That's mozilla's Amazon Associate link. So if you, like me, tend to buy stuff from Amazon after searchinf for it with the firefox search box, then Mozilla is getting a percentage of whatever you buy. I don't mind that, but I've just never seen it mentioned anywhere. It would be nice if they were a bit more upfront about that kind of income as well

    --
    http://www.popularculturegaming.com -- my blog about the culture of videogame players
    1. Re:One source of income they don't talk about... by DerekLyons · · Score: 1

      Of course they don't talk about it. The F/OSS movement generally regards software doing something without the users informed to be evil. Making money off of someone, without telling them, is (IMO) a characteristic of spyware or malware - not software I want to use.

    2. Re:One source of income they don't talk about... by Chandon+Seldon · · Score: 4, Insightful

      In my opinion that's exactly the wrong way to look at it, at least when we're talking about Amazon affiliate links. Instead, I look at it this way: Whenever you buy a n item at Amazon.com without using an affiliate code, you're throwing money away - you could be using an affiliate link and donating that money to someone you wanted to support. The fact that Mozilla sets that affiliate ID to a reasonable default (support the browser you're using) when you explicitly use the built in Amazon search box is a feature, not a bug.

      --
      -- The act of censorship is always worse than whatever is being censored. Always.
    3. Re:One source of income they don't talk about... by DerekLyons · · Score: 1

      The fact that Mozilla sets that affiliate ID to a reasonable default (support the browser you're using) when you explicitly use the built in Amazon search box is a feature, not a bug.

      How, precisely, is it a feature to do something without my consent? I don't object to donating to a cause I support - I object to donating without having consented to doing so. It doesn't matter if the company is Mozilla or Microsoft, the principle remains the same. (I know that makes me unusual nowadays - not only in having principles, but in applying them without favoritism.)
    4. Re:One source of income they don't talk about... by kchrist · · Score: 2, Interesting

      The important thing to realize here is that you're not donating anything. Amazon is donating, in the form of the referral credit they're paying for the sale of a book to you. You pay the same amount regardless. This is how affilate programs work.

    5. Re:One source of income they don't talk about... by Achromatic1978 · · Score: 1
      Except you don't have a choice about who you "want to support". Via the (default) search engine provider, Mozilla is your affiliate. Want to change that? Oh, no problem. Learn about the XPI, rewrite the JavaScript. Not a problem!

      Why would it not be entirely simple to allow users to opt in? You know, that concept that we generally like to cheer, not forcing users to opt out of using specific functionality?

    6. Re:One source of income they don't talk about... by Chandon+Seldon · · Score: 1

      Somehow I don't see the other option (default to donating to Amazon.com) as being better than what they have now. If you want to use a different affiliate link, you can always click through to Amazon.com from somewhere else.

      --
      -- The act of censorship is always worse than whatever is being censored. Always.
    7. Re:One source of income they don't talk about... by Achromatic1978 · · Score: 1

      Yeah. And Mozilla is saying to Amazon, "this guy here, he wants his affiliate referral credit to come to us", which is by no means necessarily the case. At worst, it is misrepresentation.

    8. Re:One source of income they don't talk about... by DerekLyons · · Score: 1

      My identity is being used without my permission. My choice of which sites to browse is being used for profit. The important thing to realize here is that Mozilla is doing so without informing me and without obtaining my consent.
       
      No matter how much you try and spin it - to do so is wrong.

    9. Re:One source of income they don't talk about... by Danny+Rathjens · · Score: 1

      It's not free money. Amazon paying money to the people surreptitiously using referral codes means that Amazon charges more to the consumer overall.

    10. Re:One source of income they don't talk about... by adolf · · Score: 1

      I look at it another way, by which I assume that one pays for it one way or the other.

      1. One does not offer the greatest benefit to Mozilla by purchasing through the Firefox affiliate link; instead, their revenue would probably be a lot higher if you just donated to them directly. There would be fewer accountants to pay, and fewer books for them to keep. By donating directly, one can eliminate entire fucking corporations from the money trail (*cough* Amazon), and displace any of the needless workers they most assuredly pay (with your money) to fondle your money before passing it onto Mozilla.

      2. One does not throw away money by not using the Firefox affiliate links. If nobody used affiliate links, Amazon would be able to afford to broadly lower their prices, through decreased payouts and staff reassignment/downsizing. Once prices are lower, one has more money by which to directly donate to Mozilla.

      There's no such thing as a free lunch/discount/clearance/sale/donation/kickback -- at the end of the day, the consumer always pays. Personally, I'd rather pay as little as possible.

    11. Re:One source of income they don't talk about... by Chandon+Seldon · · Score: 1

      Amazon paying money to the people surreptitiously using referral codes means that Amazon charges more to the consumer overall.

      That's true, to some extent, but Amazon charges you the same price whether you use a referral code. If you don't like Amazon's referral-code based marketing plan, buy your books at Barnes & Noble. Amazon happens to have paid for a search toolbar in the official Firefox package - if the Mozilla Foundation wants to accept their money for that (and they do), they only have the choice between including a referral code or not. Not doing so would be throwing away money.

      --
      -- The act of censorship is always worse than whatever is being censored. Always.
    12. Re:One source of income they don't talk about... by bigbigbison · · Score: 1

      Actually it isn't that hard. Just go into the searchplugins folder (in Windows it is the one in the program files folder, not your user folder) open the amazon film in a text processor and where it says mozilla-20 put in a different referral id and then save. That's it.

      If you buy a lot of stuff from Amazon it is worth opening your own Amazon associate account and putting your own id in there. I'm sure it is against Amazon's terms of service but I've done it for over a year and Amazon has given me the referral fee for all my purchases so far.

      --
      http://www.popularculturegaming.com -- my blog about the culture of videogame players
    13. Re:One source of income they don't talk about... by Chandon+Seldon · · Score: 1

      One does not throw away money by not using the Firefox affiliate links. If nobody used affiliate links, Amazon would be able to afford to broadly lower their prices, through decreased payouts and staff reassignment/downsizing. Once prices are lower, one has more money by which to directly donate to Mozilla.

      I strongly doubt that you'd see a noticeable price drop if Amazon ended their affiliate program. If we ignore affiliate sales for a moment, we can see that Amazon is competing with other online stores reasonably successfully with their current prices. The affiliate sales are *in addition* to that, and result in extra sales at a lower margin. If they lowered their prices overall, they'd lose all the extra money they're making on their non-affiliate sales.

      --
      -- The act of censorship is always worse than whatever is being censored. Always.
    14. Re:One source of income they don't talk about... by Anonymous Coward · · Score: 0

      I just thought you'd like to know that all of western civilization exists, in no small part, because of one act of censorship. ;)

    15. Re:One source of income they don't talk about... by Anonymous Coward · · Score: 0

      Nonsense. If nobody could use affiliate links, then Amazon would be far less popular, lose money, and prices would likely go up.

      How do we know this?

      Let us remember, Amazon is not some moron in a basement. They use affiliate links because they're ultimately profitable for them, not as a charity case. It gets more eyes on their site and helps build the name. It also lets them know where their traffic comes from. It has worked very well for them.

      Likewise, they're good for Mozilla because people wouldn't think to make an independent donation to them, where they're quite happy using an affiliate link.

      Your entire argument is worthless. You should have thought it out first.

    16. Re:One source of income they don't talk about... by Plugh · · Score: 1
      Quoth Chanon Selddon:
      Whenever you buy an item at Amazon.com without using an affiliate code, you're throwing money away

      Unless, of course, you own AMZN shares ...

    17. Re:One source of income they don't talk about... by adolf · · Score: 1

      Your entire argument is worthless. You should have thought it out first.

      I agree.

      Thank you for pointing that out.

  23. Should they ???? - YES ! by unity100 · · Score: 2

    should Firefox's 1,000 to 2,000 developers and 80,000 evangelists have full knowledge of how revenue is spent

    Yes.

    Open source was a method that is unheard of for creating and publishing things some time ago, and its proving that it is an unprecedented success, as it was pitted against hulky big proprietary method-using corporation's stuff and coming out stronger every day.

    Some non-it sectors and foundations are going to employ open source methods for doing things. Manufacturing, hardware was recently discussed. If it goes like this, we can find many stuff being further developed by open source methods, imitating its success in i.t. So, it is changing our world.

    Now hear this - privacy, finance and transparency are the present issues to integrate with open source, but when they are once integrated with it, and a transparency by ensuring privacy and a usable financial method is achieved, then there will be no reason not to implement these methods in areas from manufacturing to government.

    in short, i am telling that the methods invented in open source foundations can be the key to revolutionizing the governmental systems in the world, getting much more closer to direct democracy and full transparency concepts.
  24. new meaning to web cache/cash by thanksforthecrabs · · Score: 1

    Mozilla in bed with a company that condones censorship in China to make a few bucks. Nice!

    What ever happened to talks of the Firefox/RealAudio partnership? That's one app I do NOT want on my computers.

  25. Funny... by MvD_Moscow · · Score: 2

    It's funny to see all these "Mozilla is Evil!" posts. So what if Mozilla made corporate subsidy? It's been a year know that Moz Co has been in operation, so where is the fallout? Did Mozilla the organization do anything shaddy? The whole Iceweasel thing is a lot of bullshit, if Mozilla wants to engage in marketing they have to protect their trademark, there are no exceptions. Mozilla's policy on trademarks is very sane, they don't act in an aggressive manner, they get in contact with the right people and sort things out.

    Mozilla succeeded exactly because they are able to make a product that can be used by average users (while at the same time allowing geeks to customize Firefox to any degree we want). Mozilla should continue with their policy of ignoring OSS populism and innovating . The idiots who are too stupid to understand why Mozilla makes certain decision should use Iceweasel.

    1. Re:Funny... by AvitarX · · Score: 1

      How exactly has Mozilla innovated at all ever?

      --
      Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
    2. Re:Funny... by bunratty · · Score: 1

      If by "Mozilla" you mean only after they switched to the Gecko engine, they came up with XUL and XBL. If you count before when they were Netscape (remember even back then they had Mozilla in the user agent string, so were in some sense "Mozilla" then), they innovated a lot more web technologies we take for granted today.

      --
      What a fool believes, he sees, no wise man has the power to reason away.
  26. Financials by traindirector · · Score: 1

    We did this for both 2004 and 2005 and will be doing it for the 2006 year financials (and then 2007 after that.) There is nothing secret here except the specific financial details that Google will not allow to be disclosed.

    Could you provide a link that shows the depth of these financials? I don't think anything can prove your point better than the numbers themselves can.

  27. Kellogg's is similar by jt2190 · · Score: 1

    The philanthropic W. K. Kellogg Foundation has a similar arrangement. The foundation receives funds from the W.K. Kellogg Foundation Trust, which is the majority shareholder of Kellogg's Corporation.

  28. Prediction by Frosty+Piss · · Score: 1

    Prediction: I see AOL in Mozilla Corp's future...

    --
    If you want news from today, you have to come back tomorrow.
  29. Advertise Firefox by Mal+Reynolds · · Score: 1

    There is one very good use for the money, advertising.

    After a certain point, the only way to grow a brand is through advertising.

    The Firefox adoption rate amount techies (and friends and families of techies) has probably peaked. The only way non-techies will learn the benefits of Firefox is through mass market advertising.

    Some will probably be agast at the thought of open source revenue being funneled to mass market, for-profit companies. But I believe these ends justify these means.

    Advertising could result in a tremendous growth in Mozilla's adaption. This growth in market share would in turn result in ever larger revenues.

    Even so, the ends are not revenues, the ends are market share. And with ever larger market share come larger revenues. With larger revenues, Mozilla could afford to spend/donate ever larger amounts of funds to worthy projects. They could even specify that the marketing budget be limited to a certain dollar figure or percentage of revenue.

    Without advertising, Firefox will probably continue a slow growth curve over the next few years. But the days of rapid increases in Firefox's install base are probably over unless there is some form of advertising.

  30. So...who makes what? by bogie · · Score: 1

    Is someone there making 5 million a year? Which devs get paid and how much? $50 million is a lot of money to spread around when you have only ~40 employees( per mozilla.org site announcing reorg from 2005). Are you more or less inclined to work hard on a project that is making that much money from your contributions?

    These same questions have been around for quite a while but it's still fun to revisit them. While I don't think that the money will stop people from contributing their time, I do think they have a snow ball's chance in hell of ever asking for money again to do another NY Times ad.

    --
    If you wanna get rich, you know that payback is a bitch
    1. Re:So...who makes what? by asa · · Score: 1

      We're actually about 100 employees today. Also, we pay taxes on that revenue and we have non-trivial operating costs -- employees, community support and empowerment, facilities, and definitely in the infrastructure that we've built out to support the 500,000 Firefox downloads that we serve every day, the millions of daily sessions at our various web properties, the 100 million or so application security updates we ship every 6-8 weeks, etc.

      No one at Mozilla is getting rich. I'd wager that most people at Mozilla could go elsewhere and probably do better. We're here because we love doing what we're doing. That Mozilla has the resources to support so many community members with full-time salaries is a good thing - an amazing thing. We were 10 people when the Foundation started and we're about 100 today. Many former part-time volunteers are now able to spend a lot more time working on Mozilla projects and that's a great thing.

      I was spending 20-30 hours a week volunteering for Mozilla long before I was getting paid to do it and a lot of other Mozilla employees were also volunteers before coming on full-time. If you're interested in full-time work with Mozilla, see our careers page: http://www.mozilla.com/en-US/about/careers.html

      - A

    2. Re:So...who makes what? by Achromatic1978 · · Score: 1
      I was amused to see you flagging "employees" as a non trivial operating cost. Correct, but not exactly something other companies are immune to.

      Remember that link you threw out for Mozilla's financials? There's an interesting line there in which the company details its "Total Functional Expenses", including many of those things you mention: remuneration, telephone, travel, conferences, consulting fees, etc. Sum total in 2005: $2.96M.

      Assuming Mozilla Corp has doubled in size between 2005 and 2006 financial years (as 2006 isn't posted on that site), $6M is still just a tiny bit shy of $52M.

      I do see, though, that the company is just sitting on $22.1M in cash, and another $9M in investments.

      So, yeah, you'll forgive me if I'm a little confused that your statement is along the lines of "we're breaking even, after we cover our costs", when your costs are less than 10% of assets (and 5% of projected revenues alone).

    3. Re:So...who makes what? by asa · · Score: 1

      Achromatic1978, Mozilla hasn't released 2006 financials yet. When it does, you can evaluate them. Making guesses based on 2005 numbers will most likely be pretty far off (especially given the differning breakdown between taxible and non-taxable revenues.) Also, you're pretty far off on even your 2005 math so you might want to re-read the documents.

      All that being said, nowhere did I claim that Mozilla was "breaking even". If we were, how could we have had $29M on hand at the end of 2005.

      Finally, my post was a response to bogie's comment "Is someone there making 5 million a year? Which devs get paid and how much? $50 million is a lot of money to spread around when you have only ~40 employees( per mozilla.org site announcing reorg from 2005)." and I stand by it. We are a much larger organization, doing a lot more than we were in 2005.

      - A

    4. Re:So...who makes what? by Achromatic1978 · · Score: 1
      Thanks for your reply. I'll be the first to admit IANAA. The 2005 math is based on the IRS's bottom line: Total Functional Expenses. Duly noted re 2006, though.

      And I totally agree re your replying to bogie.

    5. Re:So...who makes what? by BZ · · Score: 1

      > $50 million is a lot of money to spread around

      You seem to be assuming that all the money is being spent. The Mozilla financials (which are public) show that this is not the case. A significant portion is being saved.

      Which is a good thing -- it means that if at some point in the future Google demands something that is not consistent with the Mozilla Foundation mission Mozilla can walk away from the arrangement and continue to operate off the savings while looking for another revenue stream.

  31. Re:what's the problem?/it's a Microsoft product by Anonymous Coward · · Score: 0

    Firefox is primarily a Microsoft Windows product. That's the real economic bottom line and the big huge problem that is always there, yet very few FF evangelists will recognize it or admit to it. Most of the effort with FF goes into perpetuating the windows operating system. The vast bulk of FF users still shovel cash and mindshare towards Redmond and are helping to maintain that destructive economic monopoly. If anything, the mere existence of FF/Mozilla being ported to windows from day one (the originator is a windows user) gave MS a lot of welcome and needed breathing room while they were developing vista and trying to improve IE and deal with a complete lack of security. It was worth billions to microsoft as a bandaid they didn't have to pay a penny for, while they developed more, so all this talk of google and a few paltry million is what is called a "red herring".

    Mozilla is a Microsoft *partner* for all intents and purposes.

        Now imagine if FF/mozilla products were developed for open source operating systems *exclusively*, with zero windows port. All the latest nasty web based bugs over the past few years would have forced MS OS users to look elsewhere, probably to apple or open source. Instead, FF gave them a security and functionality snuggle blanket to continue to be able to surf on windows, which just perpetuates the MS desktop monopoly.

    And before anyone chimes in with the expected knee jerk indignant reaction "but..but.. FF is open source,we have a secret plan! Using FF will magically make people adopt open source OS!". I say that's pure unadulterated crap, there is no proof, open source operating system adoption on the desktop is statistically no better now than it was 3-4 years ago, it hit a plateau at around 1-2% and remains there. Apple/mac has increased some, but not linux! Not in any huge way, any gains are so pitifully small as to be lost in the web stats noise. Same to be said for Open Office, another stealth microsoft product crutch.

  32. antiphishing... by Anonymous Coward · · Score: 0

    How about this -- antiphishing protection in FF2 exists mainly to allow harvesting data about FF's userbase by Google.
    For instance -- bug 368255 is still not fixed; not only that - it looks like it is completely ignored by devs: "UNCONFIRMED" status is default for all new bugs.
    Also, feel free to browse all bugs related with anti-phishing protection...

  33. 52 million??? by ThirdPrize · · Score: 1

    they could afford to get a couple of proper programmers for that.

    --
    I have excellent Karma and I am not afraid to Troll it.
  34. Mozilla Summer Of Code? by egghat · · Score: 1

    MSOC would be a better idea IMHO. Money for new features.

    Mozilla could even extend it far beyond Mozilla (why not KDE, Gnome, GCC, Perl (Javascript on Parrot?), etc. pp.?)

    Btw. I think the deal with Google is *so* good, that e.g. the KDE guys (Konqueror) should do a similiar deal too.

    Bye egghat.

    --
    -- "As a human being I claim the right to be widely inconsistent", John Peel
  35. Fundamental difference. by jotaeleemeese · · Score: 1

    Is the software free (as per FSF's definition?)

    The good guys are the ones that keep these fundamental freedoms. The bad guys would be the ones limiting our computing infrastructure choices and imposing artificial lock ins.

    Fill in the blanks as appropriate.

    I don't care which commercial deals are agreed between the different entitites supporting differen software projects, if they want to trade first borns it is up to them, I just want software I can migrate if necessary and that does not kidnap my data by following and encouraging industry wide standards.

    --
    IANAL but write like a drunk one.