Mozilla says it's finally done with Onerep
krebsonsecurity.com94 points by todsacerdoti 5 hours ago
94 points by todsacerdoti 5 hours ago
Good. I really wish Mozilla would rely less on these shady backroom deals and open up to direct user funding. The Mozilla Foundation accepts donations, but they don't go toward funding Firefox; instead, they fund advocacy campaigns.
> Firefox is maintained by the Mozilla Corporation, a wholly-owned subsidiary of the Mozilla Foundation. While Firefox does produce revenue — chiefly through search partnerships — this earned income is largely reinvested back into the Corporation. The Mozilla Foundation’s education and advocacy efforts, which span several continents and reach millions of people, are supported by philanthropic donations.[1]
[1]: https://www.mozillafoundation.org/en/donate/help/#frequently...
>I really wish Mozilla would rely less on these shady backroom deals and open up to direct user funding.
I have nothing against this, but at best it would be a modest side hustle. The major comparables in online user fundraising are Wikipedia, which AFAIK is the largest annual online fundraising drive in the world and it raises less than 50% of what search licensing gets. Tor is another one, but off the top of my head, I think it's maybe 1/20th of what Wikipedia raises.
If Firefox stood up a donation drive for the first time I would guess Tor-level revenue and maybe it might crawl upward from there depending on how things go.
Also, my understanding is their organizational structure is what legally enables them to do the search licensing which is their biggest revenue stream. But it means that their browser development is done to generate commercial revenue. If they moved the core browser development under the Foundation, it would unravel the ability to do search licensing deals to support development, which are much stronger than whatever their prospect for user donations would be.
I'm a bit out of my depth here but I believe it's all about the search licensing.
>The major comparables in online user fundraising are Wikipedia, which AFAIK is the largest annual online fundraising drive in the world and it raises less than 50% of what search licensing gets.
All this shows is that Mozilla is even less efficient than Wikimedia! There are projects such as Rust and LLVM that rival Firefox in complexity with 1/10 the combined expenses. Of course Rust has a selling point and Firefox doesn’t, but whose fault is that really?
> Rust and LLVM that rival Firefox in complexity with 1/10 the combined expenses
You could argue LLVM is technically of a similar level of complexity, but operating a browser requires far more actual business than developing a compiler.
More to the point, those organisations get enormous amounts of "free" labour in the form of contributions from large corporations that benefit from them, in a way that Firefox absolutely does not.
Firefox replaces more code in a month than Rusts' entire codebase even contains. Rusts' expenses are massively subsidized by donated staff time from over a dozen major tech companies.
Wikipedia is a fundamentally different beast serving static content with practically zero of the engineering overhead associated with Rust let alone with Firefox.
>Firefox replaces more code in a month than Rusts' entire codebase even contains.
Point taken. Rust + LLVM is almost half of Firefox though, and probably at least equivalent in terms of necessary skill. It is also not clear how much of that code could be removed without much loss of functionality.
>Rusts' expenses are massively subsidized by donated staff time from over a dozen major tech companies.
This is called having a selling point. If Firefox offered anything besides not being Chromium, people would work on it without getting paid by Mozilla.
There's no such thing as a developer tooling subsidy for a web browser.
Okay. KDE is absolutely comparable to Firefox according to https://openhub.net/p/kde. Tiny fraction of the expenditure. I’m not even sure what their selling point is, but it’s a lot better than Mozilla’s.
>Good. I really wish Mozilla would rely less on these shady backroom deals and open up to direct user funding. The Mozilla Foundation accepts donations, but they don't go toward funding Firefox; instead, they fund advocacy campaigns.
Yes, charitable donations go to charitable causes, not development of a browser which produces profits for a for-profit entity. There's no legal way to channel charitable donations back into a business. To do otherwise would be tax fraud.
This is not a "gotcha", this is a persistent misunderstanding of what is and is not possible in tax law.
There are however two options available:
* Make the browser development the charitable work, or
* accept funding to non-charitable company
However Mozilla earns "enough" from Google, so they don't have to try to make either work.
> Make the browser development the charitable work
They probably cannot do this. The IRS generally does not consider writing open source software to meet the requirements of a 501c3, for example [1]. They aren't super consistent about it so some groups have gotten 501c3 exemption in the past, but for the most part there is a reason that 501c3 open source foundations focus on support activities, conferences, and not software development.
> accept funding to non-charitable company
They could do this, just like they did for Thunderbird, and I wish they would.
[1] https://www.mill.law/blog/more-501c3-rejections-open-source-...
Maybe we can make a deal with the government. In exchange for making the development of open source software a tax exempt charitable work, we remove private jets from the list of purchases that can be deducted from income taxes. Seems like a win-win.
Why would the government wish to remove private jets from the list of purchases that can be deducted from income taxes? Why would they be unable to do this without making a deal with people who want open source software development to be designated a charitable purpose? How would making a deal with people who want open source software development fix this?
Why isn’t the browser development organized as charitable work?
From the Corp’s Wikipedia page [0]:
> As a non-profit, the Mozilla Foundation is limited in terms of the types and amounts of revenue it can have.
Is this an oblique way of saying they couldn’t take Google bucks that way?
> Even though an organization is recognized as tax exempt, it still may be liable for tax on its unrelated business income.
So, they could still take Google's payment and they would still have to pay taxes on it?
>Make the browser development the charitable work
I don't think there's a legal way to fund development form the profitable venture and also accept charitable donations.
I'm sure if donations were more a better bet than search licensing they might go that way, but as I said in a different comment, the biggest annual donor drive in the world is probably Wikipedia, probably a best case scenario for that kind of drive, and it brings in less than half of what their search licensing gets.
Then they wouldn't be able to pay their CEO $7 million a year...
Search revenue minus the cost of a CEO (slightly more than 1% of that goes to the CEO) is still an amazing deal, dramatically more than what's likely on offer in terms of charitable giving. They would basically have to execute the largest donation drive in the history of the internet and replicate it on a yearly basis to replace search licensing.
Frankly, they probably could. That's a pretty middle-of-the-road salary for a CEO of a significant nonprofit.
You can make donations to a for-profit business. You just can't deduct it from your taxable income.
I don't have any input on direct user funding for Firefox, but Thunderbird is also developed by a for-profit entity and accepts direct user funding with no charitable tax deductions as well. [0] https://www.thunderbird.net/en-US/donate/
Exactly, and to my knowledge the receiving party needs to pay profit tax on them. It's called a donation, but technically more of a pay-what-you-want model. Several businesses do that.
But then it would be possible to fund firefox development directly, just not get the tax break for it right ?
sell $50 keychains. done.
The corporation already sells user-facing products: Mozilla VPN, MDN Plus, Firefox Relay, Pocket (previously).
Feel free to subscribe to them to give money directly to the Mozilla Corporation, the future you're looking for is already here.
it's particularly strange to see Mozilla engage in these silly machinations when the Thunderbird team has moved on to the model of direct user funding.
I wish they would let users fund Firefox development directly and not Mozilla's own agenda
Users can fund Firefox development by subscribing to Firefox Relay, Mozilla Monitor, Mozilla VPN, or MDN Plus.
This sounds extremely necessary, but what warrants the funds reaching such a exclusive destination?
I think that Firefox needs an exclusive non-profit foundation, but I don't think Mozilla Corporation/Foundation would allow it, so a fork with a new name (marketing problem) sounds necessary (although splitting the forces may not be a good idea?), I wonder if the current Firefox's forked communities could join forces to create such non-profit foundation, and start from there, making grow the developers under such non-profit foundation, the new main tree.
Browser development is done by Mozilla Corporation which is a for-profit entity. It's illegal to donate to it. This is by design of the US tax code.
You can donate to Mozilla Foundation (parent entity of Mozilla Corporation), which is a non-profit. But you can't expressly state that the money go towards browser development.
It's perfectly legal under US law to donate to a for-profit corporation. The donor just can't take a tax deduction for it.
It is legal. But most for profit corporations don't solicit gifts because it isn't worth the compliance costs and risks. Some were punished when donors took tax deductions. Or the IRS decided their disclosures were inadequate. Or they overlooked a state or province regulation. And they were not associated with non profit foundations with similar names.
Anyone can give Mozilla Corporation money by purchasing services.
Do I understand correctly that the parent nonprofit Foundation can decide to use some of its donor money to fund its for-profit Corporation (with the same tax treatment as any other investment, and of the corporation’s profits before they’re returned to the Foundation)? But donors can’t direct their gifts to that use if the donors still intend to deduct them as charitable donations?
And thus I guess Foundation has to do a good amount of conventional non-profitty stuff like “education and advocacy,” otherwise it would just be a flimsy facade for what’s substantially a for-profit endeavor?
Why is the browser arm organized as a for-profit at all?
It's the other way around, Mozilla Corporation is profitable and those profits go directly to the Mozilla Foundation which owns 100% of it.
This idea that Mozilla doesn't have enough money to fund Firefox is just wrong, Firefox development is perfectly sustainable, it earns more money than it spends. If you want to give money to the Mozilla Corporation instead of the foundation, you do the same thing as with any company: you purchase products from them (such as their VPN or MDN Plus, both of which are owned by the corporation).
> Why is the browser arm organized as a for-profit at all?
So that they can make business deals with the likes of Google, which they wouldn't be able to do as a non-profit.
Edit: I really wish there was a single thread about Mozilla here that doesn't devolve into this being like 80% of the comments. Maybe one day.
Right. It is legal. But in the tax code it's called a "gift", rather than a "donation".
how much have you funded?
Why would you think they have funded anything given that they clearly stated they are against funding Mozilla's agenda which is currently the only option?
Would they otherwise? Unlikely, the internet is a moocher's paradise
Um, if they are asking for an avenue to do so, probably yes?
I personally spend hundreds a month on charitable donations - to political advocacy groups, social outreach organizations, and to open-source software that provides me immense value. I think this is one of the most direct ways I can influence the world around me.
It is well known in fund raising most people who say they would donate will not donate. And anyone can give Mozilla Corporation money now by subscribing to their services.
Can't speak for them, but I agree with the sentiment, and I've given them at least $1000.
I sure as hell wouldn't give them money these days. Pretty pissed at the direction they've been heading.
Nobody has funded the browser, because nobody can find the browser. You can't gotcha people with not giving money to other causes than the one they said they wanted to support.
Glad Mozilla finally ended the Onerep partnership—too much conflict of interest in the data broker world.
just seemed obvious to me that someone asking for all your personal information so they can "help delete it" is probably crooked
how do mozilla keep being fooled by these things?
> Onerep’s founder had created dozens of people-search services
How in the world was this not considered fraud, or in the very least - breach of contract?
those are, for better or worse, legal businesses.
breach of contract: unless it was in the contract that he warranted that he didn't/wouldn't do this, it's not a breach of contract?
It does showcase extremely poor due diligence from Mozilla.
"403 Forbidden" error unfortunately.
[flagged]
Mozilla said[0] they would end their partnership with OneRep back in March 2024. In February 2025, Brian Krebs discovered[1] they were still using the service.
Maybe the relationship will end this time.
[0]: https://krebsonsecurity.com/2024/03/mozilla-drops-onerep-aft...
[1]: https://krebsonsecurity.com/2025/02/nearly-a-year-later-mozi...
typical of Mozilla to collude with data brokers. They've been selling their soul it for years. Google, Perplexity, Amazon, Bing, etc.
There is an annoying bug in firefox where user/pass autofill doesn't work for some websites, like reddit or others.
Still not fixed
Damn, I apparently missed the memo that the backend service for Mozilla Monitor was shady while I used it.
Are there any actual services like this that work properly? I've noticed whenever it indicated that a service has removed my data, that same service would come back online as having my data a few weeks later.
Wondering the same thing, like is DeleteMe better? Or at least not like this thing?
Mozilla says they have "high standards for vendors" in their latest statement, but why didn't those standards apply back when they were told about this in March 2024?
https://krebsonsecurity.com/2024/03/mozilla-drops-onerep-aft...