I doubt Mullvad would be doing this if they weren't getting compensated given they've always said (even right now[1]) they don't offer a free tier since they don't believe it makes sense.
The other aspect is I expect it would stain the IP pool further. VPN IPs often end up on various blacklists due to abuse and introducing a wave of free users would only make it worse for paying customers.
> Why no free plan? "Free" services nearly always come at some cost, whether that be the time you spend watching an intro ad, the collection of your data, or by limiting the functionality of the service. We don't operate that way – at all.
I get that without any vpn in 2026. In fact theres been times I’ve been locked out, returned my user agent and ip and asked to email a webmaster to prove I am human. I guess because I use firefox.
It's mainly because nearly all VPN providers all use the same shady providers - M247, xtom, fdc, datapacket etc.. Most CDN setups will "challenge" those ASNs.
People think Mullvad is special but it's same shit as all the others in most cities/markets, I wish they would use some of their big ad money spend to deleverage from these typical dodgy scam hosting ASNs.
"Firefox’s free VPN won’t be using Mullvad’s infra though; it’s hosted on Mozilla servers around the world (if beta testing of the feature done in late 2025 tracks)."
What makes me not want to use it is I assume Mozilla has a legal presence all around the world.
Two huge reasons people use VPNs is piracy and saying things/accessing content that's not legal in their country. If that company has a legal presence in your country, then they'll hand over that data to the police should you criticize the wrong person or download a movie without permission. At which point a VPN becomes kind of pointless.
The only time i use a VPN is when i'm traveling and I don't trust "free coffee shop wifi"
I probably won't use Mozilla's offering, because i want any VPN to cover the whole system, not just the browser (correct me if i've made a bad assumption here)
I agree in principle, but we interact with hundreds of companies per day. Which ones are honest and which ones are taking advantage of us? I really don't have the cycles to run it all down, and keep up with it over time. Perhaps Firefox VPN will be totally private initially and then violate privacy 2 years in? Would I ever know? Maybe? I need to err on the side of caution for a lot of these decisions because so many companies are bad actors. I'm sure I don't always err correctly, but I don't have better options.
Firefox already had a rebadged Mullvad VPN service. I thought about switching but I found it had way fewer payment options and the log policy did not look encouraging when I read it. Made it sound like not only did it keep some kind of connection logs but that they'd cough them up pretty easily. Maybe their policy has changed but it did not seem to be a compelling offering.
True but you chose to post in the comment section of a news story, I don't think it's unreasonable to ask for more nuance than for something you see randomly in the wild.
And your point, HN would probably actually notify me if Mozilla became (more) evil. I'm just making a general point. Is my hardware store selling my information every time I enter it now that they have camera everywhere? I don't have a good way to audit it. Even if I did, I'd be failing to audit what some other evil company is doing.
It's still correct though. In this context Mozilla uses the firefox-users as their test and demo base. At the end is commercial benefit.
And I think the core criticism still applies. Mozilla gave up on the browser years ago, let's be honest. It may be interesting from a historic point of view to find out how, when and why, but meanwhile the rest of the world has moved on already, so ...
>Mozilla gave up on the browser years ago, let's be honest.
They push million lines of new code every year, push thousands of patches, and regularly achieve performance measurable performance boosts to Webrender, the JavaScript and CSS rendering engines, on rapid release cycles that have improved speed and memory usage.
There are a lot of criticisms leveled at Mozilla some fair some unfair, but the amount of work poured into the browser is so extensively documented that there's no excuse for not knowing.
This feature actually sounds like something that is aligned to Mozilla's mission of an open internet (paraphrasing).
Now, from where this cost is going to be recouped, how seamless the integration will be (in-browser translation is useful but the UX is not good enough), or if their VPN exit points aren't flagged to death as bad IPs; will remain to be seen.
The other thing about this feature, is that it will prove interesting in France and the UK; where it could be seen as a circumvention technique of the currently in place age restriction laws. And at the very least, it will bring those topics back into discussion.
Uk gov already talking about age verification (my read: identify verification) for VPN services. Grim. I'm guessing they'd block Firefox if they don't comply.
It's all about: do you derive an appropriate value for yourself from being the product?
For example, when you use the Google search engine, you are the product (Google's customers are advertisers). I hope you derive sufficient (average) value from each Google search so that you consider this to be worth it.
For a lot of people I think it's increasingly not worth it. Not only do we never click on ads, but results are getting worse, and often a (local) LLM can answer a large percentage of our questions faster and more privately.
Eh, a think tank usually has some kind of minimum requirements, such as education or industry experience. The usefulness of hackernews lies in "farming the opinions of the kind of dork that hangs out on hackernews" -- this is useful data, but "crowd sourced think tank" is trumping it up a bit i think
Eh, a think tank usually has some kind of minimum requirements
When paid for, I agree that is absolutely true.
When nearly free, thanks to team Daniel it's an input that can be weighted against paid options. The free but large crowd may have thought of things that paid think tank members members holding doctorates may not have. Great ideas are missed all the time and most often until it is too late. There may only be a few golden eggs and many bad eggs but there are quicker ways to sort that out nowadays without an Eggdicator and Oompa Loompas though I do miss the songs. One golden egg could pay for the entire cost of the staff running HN for a decade.
Y combinator absolutely profits from encouraging group think and positive attitudes about things they're involved in.
How else would you get a large part of the tech world to somehow believe that suckling on the teat of Venture capital until that elusive "exit" is the holy grail of business models?
When you use a FOSS product more, the person that wrote the code doesn't end up spending more money. When you use a free service more, someone is paying for that usage and resources.
That's not remotely the same? A default setting that can easily be changed for a feature the vendor didn't have a solution for?
To give you an example. Try to use Google Search without sending your data to Google. You cannot use the product without it, you cannot opt out. Firefox, you can use just fine with Google not being your search engine.
Why isn't it the same? The fact that it is possible to change that default means google simply pays less for it than they otherwise would if it wasn't changeable.
It's not a binary toggle - firefox is selling you as a source of revenue for themselves. They're just not making it as extreme as it is possible to be - in the hopes that you don't switch away.
You can compare same situation with safari in iOS. Except google pays a lot more, since you cannot switch away in iOS as easily, and culturally there's more reluctance compared to firefox users. This makes google pay more for iOS traffic, as those users are worth more.
> Why isn't it the same? The fact that it is possible to change that default means google simply pays less for it than they otherwise would if it wasn't changeable.
Because I can change that default and still use the thing. That's how it's very different.
Typically when people say that when something is free you are the product. They mean that it's free because your data is being sold, implying that without telemetry it wouldn't be free. That's not the case here as far as I know
The problem is that this is equivocating between "selling your data" and setting Google as the default search. The former implies Firefox is harvesting your telemetry and personally identifying you and selling it off to the highest bidder. The latter is setting Google search as an optional default, where any telemetry is part of customary interactions with Google search rather than anything specific that Firefox is doing.
The sense in which you are the product on Firefox is that they want to maintain a large enough user base that search licensing is valuable enough to sell to Google.
Google is paying Mozilla to be the default search engine. Google is only paying Mozilla because Firefox has users, regardless if they use the default search engine or not. So, indirectly everyone is the 'product'.
I'm sure if 95% of people did swap to ddg, then google may change their mind.
Also I believe there is the possibility Google also pays Mozilla to offer competition so Chrome isn't considered a monopoly (but maybe Edge has changed that to some extent?)
Don’t they buy the search bar to have another competitor and not get forced to give away chrome for antitrust reasons? I don’t think they care about the search bar THAT much, it’s basically a donation right?
But then I’m not the product? The government is basically forcing google to pay my browser developer, how does that make me the product it is bad for me?
You are still "the product" even if google derives secondary benefits - because you are using firefox. Google doesn't pay the other forks of firefox money (at least, as far as i know). It's because you aren't using those browsers (you as in the royal you).
I didn't say you being a product is bad - but it does not align customer with software company. You may be OK with being sold as a product to google, as this relationship currently isn't damaging. But what if a future offer which would damage you is taken by mozilla because it's profitable?
Browser integration means one does not need to enable the VPN system-wide as do most VPN applications. Useful if you want to switch region quickly without the OS and many apps now thinking you're in a different country and starting behaving as such.
Could be useful to quick check simple things such i18n or default behavior of a website. But for actual use, I will wait for the technical "trade-offs" as mentioned in the article.
I think a VPN is a great add-on for Firefox and way for Mozilla to monetize itself, but I'm surprised it's free. Perhaps it's a free trial like Proton?
Can we go back to making all this garbage, I don’t know, a browser extension or something?
All of this crap that everyone keeps pulling into their browsers needs to be ripped back out and made a plugin or an extension. Stop shoving it in the core damn browser. I didn’t need the waste of space and I’m never going to touch it.
Convenience. I also don't mind it in the browser as it would not really add much complexity. Some lines of code at most? VPN's do not require complex client logic - they require actual servers that reroute the user traffic - that is the expensive part.
And for many non technical users that is very useful, if they can get that with a click. To get geoblocked content, etc.
Mozilla has done way worse things, much more distracting from their core mission - building a browser that people want to use and trust.
Quite frankly I don't think it should be either. I'm sick of browsers trying to sidestep my operating system's networking stack (be it forcing their own DNS implementations for 'security' or now this BS).
There are other usecases that don't affect you which are very handy for others, such as testing site access from different countries with per-tab geo settings from a VPN extension.
I often use Opera browser's free proxy they offer for basic browsing or blocked sites. They advertise it as a free VPN but it's merely a proxy. As far as I know, it's unlimited traffic and you can choose the region it connects to.
Edge also has some Microsoft VPN with a very small amount of bandwidth for the free tier.
I'm fine with this kind of stuff as long as people are aware it doesn't offer the same connectivity as a full paid VPN.
In the Firefox case, no difference. It doesn’t encrypt traffic from your device outside of Firefox but for whatever you do inside of Firefox it’s == VPN.
Hopefully no one will start with the whole "they're Chinese owned" argument. If anybody is still on that whole trip, see this (and go watch SomeOrdinaryGamer's video on the subject) but in short it's really nothing to worry about.
Yes because it's VPN for the browser. I can do the same kind of targeting with most VPN software. Applying it to specific programs doesn't make it stop being a VPN.
> This explains it well enough though:
Which answer? The dumb bot that contradicts itself? The first human answer says it is a VPN. Though that "cyber security expert" is also not someone I would trust since they seem to think AES 128 versus 256 is actually an important difference.
The first human "no" says it's not encrypted and I don't believe that for a second.
To say more about the bot answer, it basically repeats three times that only Opera traffic goes through the VPN as its main reason. And then it says it "doesn't offer split tunneling". Come on... The rest of the answer isn't much more grounded in reality.
Is an SSH jump server a VPN (or forwarding a port from another machine at VPN)? I'd suggest neither are because it's connection-based rather than setting up a network (with routing etc). Absent a network, it's a proxy (which can be used like some deployments of a VPN).
I see your point, but I think that might label many uses of wireguard in tailscale "not a VPN" because they use imaginary network devices that only exist inside the tailscale process. Saying that would feel very wrong. On the other hand if process internals can be the deciding factor, then optimizing the code one way or the other could change whether a system is "VPN" or "not a VPN" even though it looks exactly the same from the outside. That doesn't feel great either.
And do we even know if Opera uses internal network addresses for its "VPN"?
I think I'm willing to say that routing all internet traffic from a program through a tunnel can be called either a VPN or a proxy.
Really none of these VPNs are VPNs either since they don't establish a virtual private network. They are just tunnels for your internet access. Tailscale is actual VPN software. It simulates a private network.
I usually defend Mozilla with these things, but I'm a bit bearish on this. It's not like they're not relying on big partnerships already for their survival. I don't have a problem with free to long as there is a paid plan, which I don't see on their announcement page. I don't care who is running a free-only VPN is a huge red flag, and I am one of those people that recommends using VPN services instead of running your thing on a VPS or something.
What worries me is this will get adoption and they're start talking about profiting from it via "differential privacy"
Or, even worse for the web is a more realistic problem: Firefox is notoriously hard to manage in an enterprise fleet. Their biggest hurdle to marketshare is just that, chrome works well with windows, linux and mac a like and lends itself to management. I'm frequently fighting to be allowed to use Firefox already personally. This poses a direct threat to enterprise security policies. Anyone who bans random free vpns in their networks, now has to include Firefox to that list. And I don't need to mention how bad that is for the web given Google will effectively be the gatekeeper of the entire internet, even the tiny marketshare Mozilla has will be crushed. I wonder if in retrospect, this seemingly mundane feature would be the death-blow to the only alternative browser ecosystem.
That's much better, but it is still a free VPN that bypasses network security measures. I can even imagine a threat actor deploying firefox for their command and control infra.
I self-host wireguard on a VPS for this exact reason. $5/mo and i know exactly what's running. the setup takes some effort but after that it's basically zero maintenance.
The bigger issue with browser VPNs for me is that they don't help against DPI at all. I'm in a country where the ISP fingerprints wireguard traffic and drops it - a browser VPN connecting to a known mullvad endpoint gets blocked just as fast. You need protocol-level obfuscation for that, which is a completely different problem.
You know what would be actually cool and a transformative improvement? Mozilla to make an iOS port of Firefox and publish it in regions where Apple has been forced to allow it.
Apple doesn't allow alternative browsers in those regions, it just does enough to convince the regulatory body that it allows them and the other browsers just don't want to for some reason.
As I understand it, it is just like in Opera. So a proxy not a VPN. I honestly find it distasteful that they may call it a VPN without it actually being one.
Well, only some of them actually offer full VPN service. Most of them are still just traffic-forwarding proxies, just not limited to HTTP. NordVPN used to offer full VPN service under the name "Meshnet", but actually discontinued it last year.
Depends on the VPN, I remember Nord had a private p2p network that allowed users of their VPN service to communicate directly with each other without exposing their p2p services to the greater internet.
Granted, its been a lomg time since I used Nord, not sure if they still offer that service.
> You can use them for whatever protocol you want.
the two most commons protocols used for proxying traffic support arbitrary tcp traffic.
socks is quite self explanatory but http is not limited to https either!
Of course most providers might block non https traffic by doing DPI or (more realistically) refusing to proxy ports other than 80/443 but nothing is inherent to the protocol.
> Aside from enabling secure access to websites behind proxies, a HTTP tunnel provides a way to allow traffic that would otherwise be restricted (SSH or FTP) over the HTTP(S) protocol.
> If you are running a proxy that supports CONNECT, restrict its use to a set of known ports or a configurable list of safe request targets
> A loosely-configured proxy may be abused to forward traffic such as SMTP to relay spam email, for example.
IMO if it requires a new network interface to be created on the machine, then it's a VPN. But an application-level tunnel (such as SOCKS) would just be a proxy.
We desperately need some AGI level AI to replace decision makers @ Firefox. Since the spanner that is between the cogs hinders progress big time, pig time.
That feels weird to me as well. I get that they need to trial it, but United States, France, Germany and the United Kingdom isn't really the countries I'd priorities for a free VPN.
I understand that a number of people in both the US and the UK is struggling right now and may not be able to affort a VPN, but their primary need is to avoid age restriction, while a large number countries are censoring the internet for political reasons. That latter seems more important to address.
Free VPN's are usually funded by agreeing to route some VPN traffic for other people though your own network. They basically work as mixers, randomizing traffic throughout the VPN population.
This can expose users to legal risks, but but can also add plausible deniability at the same time "it wasn't me, it was someone on VPN".
I’ve suspected that’s where these “ethical” (as they like to call it) residential proxy services get their access from. They’re really dodgy about it other than saying the people agree to it, which ya ok.
This is how I feel about it, like Firefox Send, it ended up being abused, and a free VPN will go thought the same path, as much as I want Firefox to succeed is like they never learn a lesson.
VPN is like SSL some time ago (and there were times when a browser would come without SSL, and you'd have to explicitly download it yourself) - it quickly becomes a basic necessity even in civilized societies, let alone say Russia, Iran and the likes.
So you mean I can trust an American corporation that ships its software with telemetry on by default and has a history of data-mining its users more than my standard ISP?
Ladybird(alpha) cannot come soon enough.
There's an oft repeated claim about "Modern Browsers are some of the most complex projects"
Yeah no shit, when you have browser vendors shipping features that have no place in browser, it's hardly surprising.
Why does a browser need screen sharing built in? Why does it need a vpn client?
You know there's a fucking operating system running under the browser that can run those things without worrying about how they impact on a fucking browser, right?
It's not even "arguably" for me. Of course DNS should be left to the O/S otherwise I'm going to spend half my time diagnosing why the browser is going to the wrong destination.
These "official" privacy features tend to end up being hollow masquerades when the providers inevitably capitulate to other corporations and authoritarian countries.
Like Apple's iCloud Private Relay not working in China, UAE/Dubai etc. or letting Facebook and TikTok secretly track you across devices and reinstalls with their iCloud Keychain API
They WILL leak our shit to the highest bidder or the biggest stick
FireFox need to improve their integrations and offerings to be on par with Chrome at this stage. It, at times can be such a bainful browser to use and honestly I don't think a VPN is the next step. Improved account handling & switching would be huge.
I'm not sure what you mean by account handling, but you can long-press the new tab, and you can choose a different profile (for example "work") which has a differently-colored tab. It's pretty great.
As a Firefox user: if I want a VPN I'll use an actual VPN. Focus on making a great browser, and not all this distraction.
Also, "free": "If you're not paying for it, you're the product being sold"
> "If you're not paying for it, you're the product being sold"
This is such a un-nuanced take.
In this case Firefox's route-to-market is the product. It's a distribution channel where some people who receive the free version will upgrade.
Free tiers for products where some will pay to upgrade seems like a reasonable compromise, but it does depend on how the deal is structured.
If Mullvad pays Firefox for the free users then Firefox's incentives are aligned with its users.
If Mullvad pays per conversion then it's a different story.
I doubt Mullvad would be doing this if they weren't getting compensated given they've always said (even right now[1]) they don't offer a free tier since they don't believe it makes sense.
The other aspect is I expect it would stain the IP pool further. VPN IPs often end up on various blacklists due to abuse and introducing a wave of free users would only make it worse for paying customers.
[1] https://mullvad.net/en/pricing
> Why no free plan? "Free" services nearly always come at some cost, whether that be the time you spend watching an intro ad, the collection of your data, or by limiting the functionality of the service. We don't operate that way – at all.
It's already pretty bad for mullvad. 3/4 of the websites I visit do bot checks it used to just be a few.
I get that without any vpn in 2026. In fact theres been times I’ve been locked out, returned my user agent and ip and asked to email a webmaster to prove I am human. I guess because I use firefox.
It's mainly because nearly all VPN providers all use the same shady providers - M247, xtom, fdc, datapacket etc.. Most CDN setups will "challenge" those ASNs.
People think Mullvad is special but it's same shit as all the others in most cities/markets, I wish they would use some of their big ad money spend to deleverage from these typical dodgy scam hosting ASNs.
That's true. Definitely getting worse.
"Firefox’s free VPN won’t be using Mullvad’s infra though; it’s hosted on Mozilla servers around the world (if beta testing of the feature done in late 2025 tracks)."
From OMG Ubuntu
What makes me not want to use it is I assume Mozilla has a legal presence all around the world.
Two huge reasons people use VPNs is piracy and saying things/accessing content that's not legal in their country. If that company has a legal presence in your country, then they'll hand over that data to the police should you criticize the wrong person or download a movie without permission. At which point a VPN becomes kind of pointless.
The only time i use a VPN is when i'm traveling and I don't trust "free coffee shop wifi"
I probably won't use Mozilla's offering, because i want any VPN to cover the whole system, not just the browser (correct me if i've made a bad assumption here)
It depends on whether the company keeps records or not. They can't turn over records they don't have.
>This is such a un-nuanced take.
I agree in principle, but we interact with hundreds of companies per day. Which ones are honest and which ones are taking advantage of us? I really don't have the cycles to run it all down, and keep up with it over time. Perhaps Firefox VPN will be totally private initially and then violate privacy 2 years in? Would I ever know? Maybe? I need to err on the side of caution for a lot of these decisions because so many companies are bad actors. I'm sure I don't always err correctly, but I don't have better options.
Firefox already had a rebadged Mullvad VPN service. I thought about switching but I found it had way fewer payment options and the log policy did not look encouraging when I read it. Made it sound like not only did it keep some kind of connection logs but that they'd cough them up pretty easily. Maybe their policy has changed but it did not seem to be a compelling offering.
True but you chose to post in the comment section of a news story, I don't think it's unreasonable to ask for more nuance than for something you see randomly in the wild.
And your point, HN would probably actually notify me if Mozilla became (more) evil. I'm just making a general point. Is my hardware store selling my information every time I enter it now that they have camera everywhere? I don't have a good way to audit it. Even if I did, I'd be failing to audit what some other evil company is doing.
> This is such a un-nuanced take.
It's still correct though. In this context Mozilla uses the firefox-users as their test and demo base. At the end is commercial benefit.
And I think the core criticism still applies. Mozilla gave up on the browser years ago, let's be honest. It may be interesting from a historic point of view to find out how, when and why, but meanwhile the rest of the world has moved on already, so ...
>Mozilla gave up on the browser years ago, let's be honest.
They push million lines of new code every year, push thousands of patches, and regularly achieve performance measurable performance boosts to Webrender, the JavaScript and CSS rendering engines, on rapid release cycles that have improved speed and memory usage.
There are a lot of criticisms leveled at Mozilla some fair some unfair, but the amount of work poured into the browser is so extensively documented that there's no excuse for not knowing.
It’s not correct. ‘You are the product’ implies some aspect of you -your activity or data is being sold.
In this case, you stent being sold. They are providing a limited free version and hoping you upgrade.
This feature actually sounds like something that is aligned to Mozilla's mission of an open internet (paraphrasing).
Now, from where this cost is going to be recouped, how seamless the integration will be (in-browser translation is useful but the UX is not good enough), or if their VPN exit points aren't flagged to death as bad IPs; will remain to be seen.
The other thing about this feature, is that it will prove interesting in France and the UK; where it could be seen as a circumvention technique of the currently in place age restriction laws. And at the very least, it will bring those topics back into discussion.
Uk gov already talking about age verification (my read: identify verification) for VPN services. Grim. I'm guessing they'd block Firefox if they don't comply.
> (my read: identify verification)
My read: Identity theft
I'd love to have a free VPN directly integrated into the browser, it's not a distraction. It's a developer tool for website developers.
Vivaldi integrates Proton VPN into theirs. I think it's pretty useful.
It's a distraction.
it's nice but i don't see why it has to be made and ran by the browser maker itself
Mozilla only makes the integration between the browser and the VPN, not the VPN network itself - Mozilla VPN is white label Mullvad.
According to https://www.omgubuntu.co.uk/2026/03/firefox-adding-a-free-vp... Mullvad might not be used for the free service. Whether that's correct or incorrect extrapolation we will see...
That's an existing product that may or may not be related. Unless you know something the article doesn't?
> > Also, "free": "If you're not paying for it, you're the product being sold"
> HN is "free" too. :)
Indeed: you deliver valuable information about market trends, market sentiments, technology, ... to SV startups and investors.
Additionally, Hacker News is basically a marketing expense of YC.
Well pointed. Sometimes being the "product" is not a bad thing.
It's all about: do you derive an appropriate value for yourself from being the product?
For example, when you use the Google search engine, you are the product (Google's customers are advertisers). I hope you derive sufficient (average) value from each Google search so that you consider this to be worth it.
For a lot of people I think it's increasingly not worth it. Not only do we never click on ads, but results are getting worse, and often a (local) LLM can answer a large percentage of our questions faster and more privately.
And crowd sourced think tank.
Eh, a think tank usually has some kind of minimum requirements, such as education or industry experience. The usefulness of hackernews lies in "farming the opinions of the kind of dork that hangs out on hackernews" -- this is useful data, but "crowd sourced think tank" is trumping it up a bit i think
Eh, a think tank usually has some kind of minimum requirements
When paid for, I agree that is absolutely true.
When nearly free, thanks to team Daniel it's an input that can be weighted against paid options. The free but large crowd may have thought of things that paid think tank members members holding doctorates may not have. Great ideas are missed all the time and most often until it is too late. There may only be a few golden eggs and many bad eggs but there are quicker ways to sort that out nowadays without an Eggdicator and Oompa Loompas though I do miss the songs. One golden egg could pay for the entire cost of the staff running HN for a decade.
At least free to data mine by everyone (as far as I know).
that isn't the gotcha you think it is.
Y combinator absolutely profits from encouraging group think and positive attitudes about things they're involved in.
How else would you get a large part of the tech world to somehow believe that suckling on the teat of Venture capital until that elusive "exit" is the holy grail of business models?
Do you live in 2010? Whether you pay for a service or not is irrelevant to selling your data nowadays.
> "If you're not paying for it, you're the product being sold"
This must apply to Firefox itself, right?
of course it does.
Why do you think google buys the rights to firefox's search bar (as a default setting)?
And by extension, all users of FOSS must be the product, right?
I see it more like a question than a rule.
"The service is free. Am I the product?"
That is a valid thing to ask. Even with FOSS sometimes.
Some FOSS projects are backed by companies, then yes, plausible to ask.
Otherwise, I would answer with a clear no.
(Projects can still collect telemetry and other data and sell that, though the sell part should be very rare, imo...)
Edit: Was that a bad faith argument or a honest question?
Sometimes I can't tell, maybe because of old or ESL...
When you use a FOSS product more, the person that wrote the code doesn't end up spending more money. When you use a free service more, someone is paying for that usage and resources.
And by extension, all users of FOSS must be the product, right?
Crowd sourced Development and Quality Assurance for something multiple companies, governments and the military are using.
> all users of FOSS must be the product, right?
i would default to this being the truth, until demonstrated otherwise. Call it cynical, but it's the cynical that survive.
That's not remotely the same? A default setting that can easily be changed for a feature the vendor didn't have a solution for?
To give you an example. Try to use Google Search without sending your data to Google. You cannot use the product without it, you cannot opt out. Firefox, you can use just fine with Google not being your search engine.
Why isn't it the same? The fact that it is possible to change that default means google simply pays less for it than they otherwise would if it wasn't changeable.
It's not a binary toggle - firefox is selling you as a source of revenue for themselves. They're just not making it as extreme as it is possible to be - in the hopes that you don't switch away.
You can compare same situation with safari in iOS. Except google pays a lot more, since you cannot switch away in iOS as easily, and culturally there's more reluctance compared to firefox users. This makes google pay more for iOS traffic, as those users are worth more.
> Why isn't it the same? The fact that it is possible to change that default means google simply pays less for it than they otherwise would if it wasn't changeable.
Because I can change that default and still use the thing. That's how it's very different.
Typically when people say that when something is free you are the product. They mean that it's free because your data is being sold, implying that without telemetry it wouldn't be free. That's not the case here as far as I know
The problem is that this is equivocating between "selling your data" and setting Google as the default search. The former implies Firefox is harvesting your telemetry and personally identifying you and selling it off to the highest bidder. The latter is setting Google search as an optional default, where any telemetry is part of customary interactions with Google search rather than anything specific that Firefox is doing.
The sense in which you are the product on Firefox is that they want to maintain a large enough user base that search licensing is valuable enough to sell to Google.
It isn't the same, but it's comparable.
Google is paying Mozilla to be the default search engine. Google is only paying Mozilla because Firefox has users, regardless if they use the default search engine or not. So, indirectly everyone is the 'product'.
I'm sure if 95% of people did swap to ddg, then google may change their mind.
Also I believe there is the possibility Google also pays Mozilla to offer competition so Chrome isn't considered a monopoly (but maybe Edge has changed that to some extent?)
Don’t they buy the search bar to have another competitor and not get forced to give away chrome for antitrust reasons? I don’t think they care about the search bar THAT much, it’s basically a donation right?
> for antitrust reasons?
well, a benefit is a benefit. It doesn't really matter how it manifests does it? It's not a donation, as it is not altruistic.
But then I’m not the product? The government is basically forcing google to pay my browser developer, how does that make me the product it is bad for me?
You are still "the product" even if google derives secondary benefits - because you are using firefox. Google doesn't pay the other forks of firefox money (at least, as far as i know). It's because you aren't using those browsers (you as in the royal you).
I didn't say you being a product is bad - but it does not align customer with software company. You may be OK with being sold as a product to google, as this relationship currently isn't damaging. But what if a future offer which would damage you is taken by mozilla because it's profitable?
Browser integration means one does not need to enable the VPN system-wide as do most VPN applications. Useful if you want to switch region quickly without the OS and many apps now thinking you're in a different country and starting behaving as such.
Could be useful to quick check simple things such i18n or default behavior of a website. But for actual use, I will wait for the technical "trade-offs" as mentioned in the article.
Now we're the product whether we pay for something or not.
I think a VPN is a great add-on for Firefox and way for Mozilla to monetize itself, but I'm surprised it's free. Perhaps it's a free trial like Proton?
Proton also has a free tier.
Can we go back to making all this garbage, I don’t know, a browser extension or something?
All of this crap that everyone keeps pulling into their browsers needs to be ripped back out and made a plugin or an extension. Stop shoving it in the core damn browser. I didn’t need the waste of space and I’m never going to touch it.
Why would a VPN be a good browser extension?
Convenience. I also don't mind it in the browser as it would not really add much complexity. Some lines of code at most? VPN's do not require complex client logic - they require actual servers that reroute the user traffic - that is the expensive part.
And for many non technical users that is very useful, if they can get that with a click. To get geoblocked content, etc.
Mozilla has done way worse things, much more distracting from their core mission - building a browser that people want to use and trust.
Why does the VPN need to be integrated into the browser itself?
I don't think it should. You think it should be a browser extension. I don't think it should either be integrated or a browser extension.
I think we can interpret "browser extension" as a catch-all for "not directly built into the browser", in whatever form that takes.
Quite frankly I don't think it should be either. I'm sick of browsers trying to sidestep my operating system's networking stack (be it forcing their own DNS implementations for 'security' or now this BS).
There are other usecases that don't affect you which are very handy for others, such as testing site access from different countries with per-tab geo settings from a VPN extension.
Why is this always upvoted to the top? You realize that if they focus on only making a browser they'll run out of money?
Are you the product for Firefox too?
VPNs are no longer optional for the current internet. This is as controversial as Firefox speaking ftp.
Speaking ftp is a dev cost, not an ongoing infrastructure cost.
Yes?
I mean it's very provable that they sell access to your data and your eyeballs other companies.
I often use Opera browser's free proxy they offer for basic browsing or blocked sites. They advertise it as a free VPN but it's merely a proxy. As far as I know, it's unlimited traffic and you can choose the region it connects to.
Edge also has some Microsoft VPN with a very small amount of bandwidth for the free tier.
I'm fine with this kind of stuff as long as people are aware it doesn't offer the same connectivity as a full paid VPN.
> They advertise it as a free VPN but it's merely a proxy.
What's the difference when you're accessing it through a browser?
> I'm fine with this kind of stuff as long as people are aware it doesn't offer the same connectivity as a full paid VPN.
Are you talking about it not reaching out and affecting other programs, or is there a restriction within the browser?
In the Firefox case, no difference. It doesn’t encrypt traffic from your device outside of Firefox but for whatever you do inside of Firefox it’s == VPN.
In Opera, with their "VPN" it only affects traffic within the browser and it sounds like that's the same thing Firefox will offer.
A proxy isn't as secure as a full VPN. I had previously read a really good article on it but I hunted and hunted but couldn't find it.
This explains it well enough though:
https://www.quora.com/Is-Opera-browser-with-built-in-VPN-a-g...
However, reading the write up from Opera it's actually pretty decent tech that they've had audited by a third party and the whole nine:
Why browsing with Opera’s VPN is safer https://blogs.opera.com/security/2025/07/opera-vpn-is-safe/
Hopefully no one will start with the whole "they're Chinese owned" argument. If anybody is still on that whole trip, see this (and go watch SomeOrdinaryGamer's video on the subject) but in short it's really nothing to worry about.
Debunking misinformation about Opera’s browsers https://blogs.opera.com/security/2023/07/debunking-spyware-m...
> it only affects traffic within the browser
Yes because it's VPN for the browser. I can do the same kind of targeting with most VPN software. Applying it to specific programs doesn't make it stop being a VPN.
> This explains it well enough though:
Which answer? The dumb bot that contradicts itself? The first human answer says it is a VPN. Though that "cyber security expert" is also not someone I would trust since they seem to think AES 128 versus 256 is actually an important difference.
The first human "no" says it's not encrypted and I don't believe that for a second.
To say more about the bot answer, it basically repeats three times that only Opera traffic goes through the VPN as its main reason. And then it says it "doesn't offer split tunneling". Come on... The rest of the answer isn't much more grounded in reality.
Is an SSH jump server a VPN (or forwarding a port from another machine at VPN)? I'd suggest neither are because it's connection-based rather than setting up a network (with routing etc). Absent a network, it's a proxy (which can be used like some deployments of a VPN).
I see your point, but I think that might label many uses of wireguard in tailscale "not a VPN" because they use imaginary network devices that only exist inside the tailscale process. Saying that would feel very wrong. On the other hand if process internals can be the deciding factor, then optimizing the code one way or the other could change whether a system is "VPN" or "not a VPN" even though it looks exactly the same from the outside. That doesn't feel great either.
And do we even know if Opera uses internal network addresses for its "VPN"?
I think I'm willing to say that routing all internet traffic from a program through a tunnel can be called either a VPN or a proxy.
Really none of these VPNs are VPNs either since they don't establish a virtual private network. They are just tunnels for your internet access. Tailscale is actual VPN software. It simulates a private network.
WireGuard is VPN software. Tailscale is WireGuard-as-a-service.
It comes down to encryption. Proxies aren’t usually encrypted, I don’t know what it does in opera or Firefox’s case.
I usually defend Mozilla with these things, but I'm a bit bearish on this. It's not like they're not relying on big partnerships already for their survival. I don't have a problem with free to long as there is a paid plan, which I don't see on their announcement page. I don't care who is running a free-only VPN is a huge red flag, and I am one of those people that recommends using VPN services instead of running your thing on a VPS or something.
What worries me is this will get adoption and they're start talking about profiting from it via "differential privacy"
Or, even worse for the web is a more realistic problem: Firefox is notoriously hard to manage in an enterprise fleet. Their biggest hurdle to marketshare is just that, chrome works well with windows, linux and mac a like and lends itself to management. I'm frequently fighting to be allowed to use Firefox already personally. This poses a direct threat to enterprise security policies. Anyone who bans random free vpns in their networks, now has to include Firefox to that list. And I don't need to mention how bad that is for the web given Google will effectively be the gatekeeper of the entire internet, even the tiny marketshare Mozilla has will be crushed. I wonder if in retrospect, this seemingly mundane feature would be the death-blow to the only alternative browser ecosystem.
Mozilla has offered paid VPN plans for over 5 years now. This is just adding a free tier to that.
https://www.mozilla.org/en-US/products/vpn/
That's much better, but it is still a free VPN that bypasses network security measures. I can even imagine a threat actor deploying firefox for their command and control infra.
FWIW, we'll have a secure, enterprise version of Firefox available later this year.
I self-host wireguard on a VPS for this exact reason. $5/mo and i know exactly what's running. the setup takes some effort but after that it's basically zero maintenance.
The bigger issue with browser VPNs for me is that they don't help against DPI at all. I'm in a country where the ISP fingerprints wireguard traffic and drops it - a browser VPN connecting to a known mullvad endpoint gets blocked just as fast. You need protocol-level obfuscation for that, which is a completely different problem.
I love the smell of bloatware in the morning
You know what would be actually cool and a transformative improvement? Mozilla to make an iOS port of Firefox and publish it in regions where Apple has been forced to allow it.
Apple doesn't allow alternative browsers in those regions, it just does enough to convince the regulatory body that it allows them and the other browsers just don't want to for some reason.
Apple created a lot of bureaucracy around the development process [1] but it's possible. If Mozilla is truly fighting for "a better internet"
[1] https://developer.apple.com/support/alternative-browser-engi...
Wouldnt be suprised if they were working on it already
As I understand it, it is just like in Opera. So a proxy not a VPN. I honestly find it distasteful that they may call it a VPN without it actually being one.
What makes a proxy a "VPN" again? Most popular "VPN" companies only offer a proxy that merely runs over a VPN protocol.
> Most popular "VPN" companies only offer a proxy that merely runs over a VPN protocol.
Well that doesn't seem true?
Mullvad, Proton, Private Internet Access, NordVPN, ExpressVPN etc are all VPNs. You can use them for whatever protocol you want.
Well, only some of them actually offer full VPN service. Most of them are still just traffic-forwarding proxies, just not limited to HTTP. NordVPN used to offer full VPN service under the name "Meshnet", but actually discontinued it last year.
All of them offer only proxied access to the internet. They do not expose access to any "private network".
Depends on the VPN, I remember Nord had a private p2p network that allowed users of their VPN service to communicate directly with each other without exposing their p2p services to the greater internet.
Granted, its been a lomg time since I used Nord, not sure if they still offer that service.
> You can use them for whatever protocol you want.
the two most commons protocols used for proxying traffic support arbitrary tcp traffic. socks is quite self explanatory but http is not limited to https either!
Of course most providers might block non https traffic by doing DPI or (more realistically) refusing to proxy ports other than 80/443 but nothing is inherent to the protocol.
edit: this is also mentioned on MDN: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
> Aside from enabling secure access to websites behind proxies, a HTTP tunnel provides a way to allow traffic that would otherwise be restricted (SSH or FTP) over the HTTP(S) protocol.
> If you are running a proxy that supports CONNECT, restrict its use to a set of known ports or a configurable list of safe request targets
> A loosely-configured proxy may be abused to forward traffic such as SMTP to relay spam email, for example.
To complement your comment, SOCKS 5 also supports two, less known kinds of traffic: UDP and the server side of TCP
https://www.rfc-editor.org/rfc/rfc1928#page-6
IMO if it requires a new network interface to be created on the machine, then it's a VPN. But an application-level tunnel (such as SOCKS) would just be a proxy.
Because people understand VPN but not necessarily proxy. It's targeted to non-tech people.
A VPN as you refer to it isn't a VPN either. There's no private network that is virtualized. Actual VPN software is like Tailscale.
From the perspective of the browser there is no difference.
Is the proxy encrypted? If so then you might as well call it a VPN.
We desperately need some AGI level AI to replace decision makers @ Firefox. Since the spanner that is between the cogs hinders progress big time, pig time.
Why are they trying to sell a VPN in the countries where users barely need it?
https://www.pornhub.com/blog/age-verification-in-the-news
Over the past year, Pornhub had to make the difficult decision to block access to users in the following American states due to Age Verification laws:
That feels weird to me as well. I get that they need to trial it, but United States, France, Germany and the United Kingdom isn't really the countries I'd priorities for a free VPN.
I understand that a number of people in both the US and the UK is struggling right now and may not be able to affort a VPN, but their primary need is to avoid age restriction, while a large number countries are censoring the internet for political reasons. That latter seems more important to address.
A VPN is more relevant than ever in Europe.
OS age verification?
> countries where users barely need it?
Why don't they need it? There is widespread corporate and government surveillance in those countries. Privacy is a major issue. What is your standard?
Will our data be routed to Israel like every other vpn is required to do?
Who will be the first to write an extension (or utility) that allows this to be used as a general system proxy not limited to Firefox?
Do they name the service provider of this VPN or how it works? The official announcement is just as sparse on the details.
Firefox doing everything, but being a good browser.
I'm sure the UK government (which is against VPNs because they help people circumvent their Online Safety Act) will love them.
This looks like it's just a traffic proxy, and isn't actually a full VPN.
The ability to nest proxy servers using TLS would be sufficient for me.
Free VPN's are usually funded by agreeing to route some VPN traffic for other people though your own network. They basically work as mixers, randomizing traffic throughout the VPN population.
This can expose users to legal risks, but but can also add plausible deniability at the same time "it wasn't me, it was someone on VPN".
I’ve suspected that’s where these “ethical” (as they like to call it) residential proxy services get their access from. They’re really dodgy about it other than saying the people agree to it, which ya ok.
That's useful, or? Does that work in all countries?
Source: https://blog.mozilla.org/en/firefox/firefox-148-149-new-feat... (https://news.ycombinator.com/item?id=47415420)
Wait. A VPN in the browser? Isn’t the cat already out of the bag at that point?
Another Mozilla project to be discontinued in 18 months ...
This is how I feel about it, like Firefox Send, it ended up being abused, and a free VPN will go thought the same path, as much as I want Firefox to succeed is like they never learn a lesson.
https://support.mozilla.org/en-US/kb/what-happened-firefox-s...
Where's the money for this VPN going to come from? The ads they insert into my home page or the CEO's inflated compensation?
Now, from the people who brought you Pocket.
Could they please stop integrating services into Firefox? Thank you.
VPN is like SSL some time ago (and there were times when a browser would come without SSL, and you'd have to explicitly download it yourself) - it quickly becomes a basic necessity even in civilized societies, let alone say Russia, Iran and the likes.
So you mean I can trust an American corporation that ships its software with telemetry on by default and has a history of data-mining its users more than my standard ISP? Ladybird(alpha) cannot come soon enough.
Tunneling all my traffic through someone else's machine is not the same as encrypting the communication between me and the destination website.
There's an oft repeated claim about "Modern Browsers are some of the most complex projects"
Yeah no shit, when you have browser vendors shipping features that have no place in browser, it's hardly surprising.
Why does a browser need screen sharing built in? Why does it need a vpn client?
You know there's a fucking operating system running under the browser that can run those things without worrying about how they impact on a fucking browser, right?
> Why does a browser need screen sharing built in?
Is that maybe used for video calls?
Im not talking about an api. Im talking about an end user feature.
Or are you telling me that chrome has a fucking video call client built in as well?
Almost, it's about 50 lines of JS to setup a video call.
> Why does it need a vpn client?
Do think your web browser also should not have SOCKS and HTTP Proxy support? What about DNS-over-HTTPS?
Proxies are protocol specific.
A vpn is a network layer tunnel. Does your browser also include its own built in ip stack? Maybe it should have its own window system.
DNS arguably would also be best left to the OS, yes.
It's not even "arguably" for me. Of course DNS should be left to the O/S otherwise I'm going to spend half my time diagnosing why the browser is going to the wrong destination.
These "official" privacy features tend to end up being hollow masquerades when the providers inevitably capitulate to other corporations and authoritarian countries.
Like Apple's iCloud Private Relay not working in China, UAE/Dubai etc. or letting Facebook and TikTok secretly track you across devices and reinstalls with their iCloud Keychain API
They WILL leak our shit to the highest bidder or the biggest stick
nice execution. the demo video sold me more than the text
FireFox need to improve their integrations and offerings to be on par with Chrome at this stage. It, at times can be such a bainful browser to use and honestly I don't think a VPN is the next step. Improved account handling & switching would be huge.
I'm not sure what you mean by account handling, but you can long-press the new tab, and you can choose a different profile (for example "work") which has a differently-colored tab. It's pretty great.
> Mozilla said the free tier will initially provide 50GB of monthly data to users in the United States, France, Germany, and the United Kingdom.
Sadly no countries are mentioned where such VPN is really needed (due to strict internet censorship).
With Ofcom I'd say the UK falls into that group nicely.
At least now I'll be able to view all those broken Imgur links here in the UK.