Yay, I always wanted to see more spam in it!
(had the "fun" experience of needing to figure out again how to disable new spammy things from new tab page on mobile despite having already done so before)
"buzzfeednews: Teachers are moonlighting as instagram influencers to make ends meet" trending
"vox: a history of happiness explains why capitalism makes us feel empty inside" trending
"theguardian: chanel shoes, but no salary: how one woman exposed the scandal of the french fashion industry" trending
I have never visited those pages before. I had clean new tab pages showing only most commonly visited pages before, and suddenly automatically this stuff appeared in it now. I consider this spam, yes.
Also, for most commonly visited pages, all it gives me is an orange square with only an "R" in it for reddit or a green square with an "N" in it for hacker news, but for the spammy stuff above it gives full titles!
When I enable "Highlights" on the new tab page, I see pages I spent a lot of time on lately: e.g. OpenWRT recommended hardware page, Coney Island water temperature page, and a page about the Graphwiz format. None of them are related to anything in Pocket (which I also actively use), or, thank goodness, buzzfeed.
My home page is ~/home.html in all browsers. Thus it's the same in Chrome, FF, w3m, whatever. Much easier than remembering how to set bookmarks/favorites in different browsers and keep them all in sync.
Is that still the case? Did you find an easier option?
[0] Way easier than one would assume, you just need a manifest file next to your HTML file.
EDIT: A local web server instead of loading the HTML file directly also works and avoids the need for add-ons/extensions.
(short version: Mozilla can target you with a small piece of JavaScript to steal your password, then use it offline to decrypt your data)
Do we know if Mozilla is planning anything to fix this?
Nope, so far as I can tell they are invested in their current approach. In fairness, I will admit that it trades security in order to get a slight improvement in usability.
If they'd just make it impossible to log in via JavaScript, and only through the browser UI, then they could increase the security. But they won't do it.
The problem is that this happens in JavaScript which is downloaded from Mozilla's site. It would be trivial for Mozilla to target a single user with a piece of JavaScript which boils down to:
if (username === 'target') { sendPlaintextPassword(); }
It's a really nasty flaw, and the fact that they refuse to address it worries me: why don't they care about the security of their users? Why do they insist on maintaining a backdoor?
did you report this to them? if there was a bug report and they marked it as WONTFIX or something that would give more credence to your theory. otherwise, Hanlon's razor.
Disappointed these are showing up on my Firefox homepage.
I also suppose that this may be the default for a particular audience / geolocation. That is, maybe they'd show a different thing in Russia (sorry, I don't have a Russian VPN), and maybe even a different thing in Texas. Or maybe something based on your previous browsing history (e.g. if you read something like zerohedge a lot, they might show you a different, more aligned site).
I don't know, and am not inclined to thoroughly experiment. But the complete source is there, and it must be a relatively recent addition, so anybody interested could just dive in and find out. Yay Mozilla!
Second, I don't believe the source code of the algorithm that picks which news to show you is available... If there's an algorithm at all, because chances are it's curated by humans.
My recommendations for this are the BBC RSS feed, PBS NewsHour for nightly news / video (Youtube or OTA antenna) and a local paper RSS feed (Chicago Tribune for me). Though that paper has long been considered politically biased (to the right), local events are probably more important than national or worldwide news coverage so one has to bite the bullet at a point.
BBC/Tribune/PBS are simply exceptional reporting, regardless of any leanings, and I'd put that ahead of worrying about a lack of total neutrality. It's a little overblown. It's been clear for some time now that there's a bit of a struggle for right-wingers on being able to mentally muster their way through biased reporting (real or perceived). There's a lot of weak and fragile people around today, can't even watch or read something that doesn't cater to their sensitivities. It used to be that a right-winger aspired to be John Wayne. Now they're all-in on victimhood culture. If they did anything in their life at all, like get off the couch to join the military (which is a government dependent of the worst kind- one that leads to people getting killed, rather than an unpaid, sacrificial service), they're deeply offended if you're not constantly kissing the ring.
Maybe checking just the AP releases would be the best way to get "neutral news", but I think if you just hunt for sources that explicitly do not sensationalize the news, something Fox News brought into popularity, you'll get most of the way there.
Favorite browser modification: set default page to about:blank
I can add any content I want there.
Then if it phones home I have only myself to blame.
You can probably also style about:blank to have whatever you want in it when it loads. I'd imagine that is done differently depending on the browser you're using.
On the other hand, I'm not sure why you'd want to when you can just set your new tab page to a custom page of your choosing.
Edit: clarification