Mozilla lays off 250 employees while it refocuses on commercial products

It's not withering away because of minor mistakes; it's withering away because of major mistakes. Those mistakes are largely in corporate governance -- this is the reason so many are furious about the $2.5MM salary for a CEO at the helm of a market-share death spiral. Every single product line except Firefox is an also-ran from a revenue standpoint. How does Baker respond? Fire the Servo team, and tell an interviewer there will be a focus on (among other niche services) a "VR chat hub." Oh, and any salary reduction for executives is 'a burden.' (https://twitter.com/lizardlucas42/status/1293232090985705478)

All this from an organization with the audacity to solicit donations from end-users.

So no, I would not say Mozilla has learned anything or worked to prevent it happening again. What has changed since the January layoffs except for the scale of the layoffs? In no world is running a company such that you have to boot a quarter of your workforce 'minor mistakes.'

The silver lining is that Mozilla's race to receivership won't make much of a difference. They haven't done much for web standards beyond co-signing Google's railroading of the standards bodies, and they couldn't even stand up for video or DRM standards either. Every download of Firefox ships Google Analytics, installer stubs for Cisco and Google video blobs, and a configuration that shunts your DNS lookups to yet a third private corporation. With friends like Mozilla, who needs enemies?

In short, the organization is utterly rudderless (and has been for nearly a decade), incapable of supporting itself without search engine subsidies, and not achieving any of the ideological goals it espouses. What we're witnessing now is what happens when you can no longer coast on branding. What's down this road, after some deck-chair rearranging, will be cessation of operation of the for-profit arm and a new direction for the non-profit arm, which might survive that. Time will tell.

Best comment of the thread. Well done. I strongly agree.

Aside: That linked salary reduction comment is also pretty damned tone deaf. oof. I imagine having to find a new job because of major systemic mismanagement is also a burden!

Particularly excellent reference on the salary tweet. Yikes. You've hit several nails directly on the head, so to speak.

The argument for DRM is that it ships in a sandbox built by Mozilla.

But hey, I'm sure that if Mozilla didn't ship DRM, video codecs, etc, the browser would have been more popular.

Firefox is actually useful.

DNS lookups are safer with a provider vetted by Mozilla. They were able to negotiate a contract you wouldn't have been able to get. Ensuring you more privacy.

But sure bash Mozilla for trying to be pragmatic, privacy and features is not a trivial thing to balance.

Yeah, giving another 3rd party user data ensures the users more privacy.

You have some kind of doublethink going on there.

> The argument for DRM is that it ships in a sandbox built by Mozilla.

Actually, I was long since wondering how exactly that sandbox works, so if you have some more information about that, I'd appreciate it.

Henri Sivonen's general explanation of EME and CDMs[1] tells the following:

> A CDM could be bundled with the browser, downloaded separately, bundled with the operating system, embedded in hardware as firmware running in a second domain of computing (such as ARM TrustZone) or wired into hardware. EME leaves this aspect implementation-dependent. [...]

EME does not specify the output abstraction for CDMs. It leaves open several options. The CDM could:

- Merely perform decryption and hand back the encoded media (e.g. H.264) to the browser.

[...]

- Perform decryption and decoding and then work together with the GPU so that not even the operating system gets the opportunity to read the pixels back from the GPU.

Meanwhile, Mozilla's implementation of EME seems to be substantially more restrictive[2]:

> Firefox does not load [the CDM] directly. Instead, we wrap it into an open-source sandbox. In our implementation, the CDM will have no access to the user’s hard drive or the network. Instead, the sandbox will provide the CDM only with communication mechanism with Firefox for receiving encrypted data and for displaying the results.

[...]

in Firefox the sandbox prohibits the CDM from fingerprinting the user’s device. Instead, the CDM asks the sandbox to supply a per-device unique identifier.

However, if the sandbox works as explained, the DRM seems to be trivially defeatable: I can simply fork Firefox and modify the sandbox, so it lies to the CDM about the fingerprinting and/or captures the decrypted media stream and writes it to a file - so then, how did Mozilla get Hollywood to agree on this?

On the other hand, if the CDM has some means to verify that Firefox has not been tampered with, then it can escape the sandbox - so then, what is the point of the sandbox?

[1] https://hsivonen.fi/eme/ [2] https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...

Mozilla can't build every service on the internet. Trying would be futile.

But they can collectively bargain on their users behalf.