This is hilarious popup btw. “we care about your privacy”
so we are going to:
use precise geolocation data
actively scan device characteristics for identification
share it with 756 partners
To be clear I am not complaining that they are trying to use ads, that’s fine. I’m not even trying to pick on this website in particular. I am merely pointing out the contradiction of saying “we care about your privacy” and then in the very next paragraph describing all the ways in which they will violate your privacy.
A website has every right so serve me an ad. And I have every right to disallow or mitigate the mechanisms used to “actively scan device characteristics for identification”.
My device characteristics such as my location, canvas properties and current battery level, etc… is simply non ya biz.. This is why I refuse to accept these popups, even tho I’m blocking cookies so it doesn’t really matter if I accept.
You can serve me the ad, but you don’t get spy on me and sell my data to all your friends. It not even about the ads anymore, it’s the principal of the matter. You can’t have my data unless I explicitly allow you to.
This is similar to Super Duper Secure Mode in Edge that disabled the JavaScript just-in-time (JIT) compiler to enable some extra security protections.
half of all vulnerabilities for the V8 JavaScript engine was related to the JIT process.
With the JIT engine turned off, it was possible for Edge to turn on protections – such as the hardware-based Control-flow Enforcement Technology (CET) from Intel, and Windows’ Arbitrary Code Guard (ACG) and Control Flow Guard (CFG) – that were previously incompatible with JIT.
Bounce tracking is a technique where a user clicks a link but ends up reaching their intended destination via an intermediary tracking page. This allows trackers to place and read ‘first-party cookies,’ which aren’t blocked by the browser, unlike third-party cookies.
For instance, imagine a user on flowers.example clicking a link to books.example. At the last moment, the tracker active on the former site reroutes the link through tracker.example. The user first lands on this tracking page, which then redirects them to books.example, enabling tracker.example to identify that the user is interested in both flowers and books.
An illustration depicting Bounce Through Tracking and Bounce Back Tracking
Photo credit: Google
If tracker.example manages to inject itself into the user’s browsing pattern frequently enough, it can build a detailed profile of the user. To combat this, Mozilla has announced a feature called ‘Bounce Tracking Protection,’ which will regularly cleanse Firefox of tracking data every 24 hours. The browser will utilize heuristic detection methods to identify and recognize bounce trackers.
Sadly those are still tech inclined people, normies think Google is “The Internet”, Samsung makes Chinese iPhones and have no idea tech tuber is even a thing.
These settings are not recommendations. This is mainly to document the feature, as it would fall under the category of hardening. Users must evaluate settings as it applies to them.
If you read the linked article it will explain, but in short malicious WebAsm (or malicious data parsed by vulnerable WebAsm) can lead to arbitrary code execution (breaking out of the browser sandbox).
So from the linked article lets look at some of the mitigations:
Control-flow Enforcement Technology (CET) uses a ‘Shadow Stack’ stop stack buffer overflow exploits and the use of ROP (return-oriented programming) gadgets: Intel CET In Action | Offensive Security
Control Flow Guard (CFG) is a highly-optimized platform security feature that was created to combat memory corruption vulnerabilities. By placing tight restrictions on where an application can execute code from, it makes it much harder for exploits to execute arbitrary code through vulnerabilities such as buffer overflows. CFG extends previous exploit mitigation technologies such as /GS, DEP, and ASLR. win32/desktop-src/SecBP/control-flow-guard.md at docs · MicrosoftDocs/win32 · GitHub
It’s not common to run into these types of exploits in the day to day, but they do exist. These techniques are probably used more by advanced threat actors.
My level1 prediction is that once google brings the hammer down with MV3, there will be a massive shift to Firefox or chromium forks that maintain MV2.
A system called “NavBoost” (cited by VP of Search, Pandu Nayak, in his DOJ case testimony) initially gathered data from Google’s Toolbar PageRank, and desire for more clickstream data served as the key motivation for creation of the Chrome browser (launched in 2008).
Chrome exists only to collect more clickstream data. You are the product (but you already knew that).
They are targeting their first alpha release for 2026, so it will be a while. To be honest, the whole thing is giving me a bit of fishy vibes, but I could be wrong.
I don’t know, some of their sponsorships are sort of weird…
Null, a publishing company comprised of 9 superstar team members and exactly one published game with 20 positive reviews on Steam. IDK, could be the GitHub guy’s passion project for all I know…
Then Shopify is paying for it. To have another browser engine to work the bugs out? If it’s for press or publicity or whatever they are doing a shit job.
Playbit is (developing) a fourth generation operating system. Coming in 2024.
Since yesterday, FUTO joined so they will put it up on their home page and Louis Rossmann might talk about it.
And most of all, I wish they had some sort of sustainable business model, because without one it will probably die because Chromium exists.
Oh, and they should probably pay some developer in India to redo their website, it’s horrendous and it’s not helping their cause.
This should be off by default and user should have to opt-in.
Opt-out is a dark pattern.
This type of behavior is breaking trust on principal alone. I don’t care if the data is “anonymized” or “noisy aggregated”. To be clear, I am not opposed to more privacy respecting systems. But you must ask for consent before collecting more data and enabling this type of shit by default is not cool.
This is why your market share is dying mozilla. This type of behavior is why people are moving to Librewolf or chromium based browsers. This is not acceptable from a browser that claims to care about your privacy.
Mozilla: “At Mozilla, we believe that privacy is fundamental to a healthy internet.”
