Live data from Hacker News

Firefox built-in spyware that cannot be disabled

news.ycombinator.com

1–10 of 48 posts

Firefox built-in spyware that cannot be disabled

#1
Looking at about:networking I can see connections to pocket (despite me disabling pocket in about:config) as well as connections to "firefox.settings.services.mozilla.com".

And after research, it appears some of these are hard-coded into the source code on purpose for "security reasons" which is ridiculous.

Mind you, my browser is hardened to it's best.. just felt like sharing this for anyone unaware that even if you harden Firefox, even if you go the extra 10 miles and edit about:config, it will still spy on you!

Re: Firefox built-in spyware that cannot be disabled

#2
I noticed this as well and blocked it in my local DNS. I also disable DoH.

    grep firefox /etc/unbound/override/combined.conf 
     local-zone: "firefox-settings-attachments.cdn.mozilla.net" always_nxdomain
     local-zone: "firefox.settings.services.mozilla.com" always_nxdomain

Re: Firefox built-in spyware that cannot be disabled

#3
post #2

I noticed this as well and blocked it in my local DNS. I also disable DoH. grep firefox /etc/unbound/override/combined.conf local-zone: "firefox-settings-attachments.cdn.mozilla.net" always_nxdomain local-zone: "firefox.settings.services.mozilla.com" always_nxdomain

Or even good old hosts or whatever.

Re: Firefox built-in spyware that cannot be disabled

#4
This is why I use LibreWolf, which is a patched version of Firefox that removes pocket and stuff like this entirely, instead of regular Mozilla Firefox with something like arkenfox to harden it. There's only so much a config, no matter how extensive, can really do for you against what's been hard-coded into a program itself, and configs need personal maintenance, whereas a patch version of a piece of software can pull things out at the root, and will generally be maintained by people other than me. Yes, since it's a patched version there is some delay in receiving updates from upstream, but it's very small and they're extremely consistent about keeping up with new Firefox versions, since I believe most of their system is automated and it's basically the same set of patches every time. So it's no more of a risk than using a distro packaged version of Firefox instead of a Flatpak version, since distro packages add the same sort of patching by a third party delay. And most people are fine with distro packages for browsers, so there's no reason to balk here either.

Re: Firefox built-in spyware that cannot be disabled

#5

This is why I use LibreWolf, which is a patched version of Firefox that removes pocket and stuff like this entirely, instead of regular Mozilla Firefox with something like arkenfox to harden it. There's only so much a config, no matter how extensive, can really do for you against what's been hard-coded into a program itself, and configs need personal maintenance, whereas a patch version of a piece of software can pul…

[dead]

Re: Firefox built-in spyware that cannot be disabled

#6
post #2

I noticed this as well and blocked it in my local DNS. I also disable DoH. grep firefox /etc/unbound/override/combined.conf local-zone: "firefox-settings-attachments.cdn.mozilla.net" always_nxdomain local-zone: "firefox.settings.services.mozilla.com" always_nxdomain

[dead]

Re: Firefox built-in spyware that cannot be disabled

#8
yes, ff does a ton of background connections. use wireshark to see what it is doing. i tried to block all that crap once but after a while i just gave up.

it is still my primary browser because it is now the only alternative to google's monopoly(even though mozilla is de facto living off of google's money).

Re: Firefox built-in spyware that cannot be disabled

#9
post #2

I noticed this as well and blocked it in my local DNS. I also disable DoH. grep firefox /etc/unbound/override/combined.conf local-zone: "firefox-settings-attachments.cdn.mozilla.net" always_nxdomain local-zone: "firefox.settings.services.mozilla.com" always_nxdomain

> I also disable DoH

Why? DoH is good for privacy.

Post reply on HN