You seriously don't have an issue with being fingerprinted and tracked every single time you open an application on your computer?
The point is that there should be zero. I should not have a single outgoing network request triggered by opening a web browser to a blank page until interacting in some way. The fact that we've lost this as a standard is terrifying to me.
I think you're looking in the wrong direction. Try the closed-source (or partial closed source) operating systems you interact with on a daily basis: Windows, Android, macOS, iOS- that's where you'll find the "fingerprinted and tracked every single time you open" sort of thing you speak of. :)
Just to point out, that "the whole point of Firefox" is to make the network requests I want.
eg from my perspective it's a tool like (say) cURL that has a specific purpose.
It's a subtle difference, but an important one. :)
I'm mainly just replying to the poster that attempted to say that since Firefox already makes network requests, ~anything should be ok.
My guess is that Firefox will not try to check for updates or other things if it notices that the detectportal-request was not successful (i.e. the user is not logged into the hotel-wifi or something like this yet).
So... guessing here, that particular request would be checking if the domain for the Firefox update check itself has a valid cert.
If that's not what it's checking, hmmm...
And you can prove this how?
All I'm saying is think twice before blindly trusting a tech company, because Mozilla is no longer the fun and friendly company we once knew. They are very much a rank and file data mining company now, generating tons of cash, and being infiltrated by CEO and marketing types.
Captive portal popup seems like an obvious UX improvement for 99% of people. I wonder how many people on HN even know how to trigger it if the browser didn't try to do it for you.
Update checking and over the air updates make obvious sense to me given that my mother and girlfriend will click "Remind me tomorrow" for years on the macOS update popup, and there's nothing user-friendly about making it so easy for users use old browser versions.
The rare user can turn both off if they want, so what's the big deal?
For anyone wondering: Just try and open literally any http page (note: no s). I use groklaw.net.
There's still neverssl.com, but with the most popular pages using HSTS like Google Facebook and Reddit, captive portal detection is essential for your average user.
Although I wish the IETF would make a standard for doing this at the network level as part of DHCP rather than the current ridiculousness we have. Captive portals are just the buggiest shit.