@firefox, the “last privacy-respecting browser” now nags you with in-browser pop-ups to let AI generate “key points” when you long-press links.

Mozilla CEO: “AI should always be a choice – something people can easily turn off”

Then why the fuck is it off by default? Why the fuck am I getting pop-ups asking me to try features I didn’t ask for? That’s not a choice. That’s opt-out with a fucking marketing budget.

What the fuck happened to you, Mozilla.

They spent WEEKS in damage control promising an "AI kill switch" and then shipped it fucking disabled. That is the most gaslit UX I have ever seen in my life.

"Help me @librewolf - you're my only hope."

Settings > AI Controls > Block AI enhancements. Do it now, because they won't do it for you.

—

Edit: a few corrections thanks to @Feyd:

“Hover over links”

• It’s a long-press / context menu action, not a passive hover. That’s a meaningful distinction because hover implies it’s happening constantly without intent, which is way more invasive than what’s actually happening.

“Sending page content to ML models”

• the default link preview (before you enable key points) just reads the Open Graph meta tags – the same og:title / og:description metadata that generates link cards in Slack, Discord, iMessage, etc. That’s not AI, that’s just HTML parsing.
• even when you DO opt into the AI key points feature, it runs a local on-device model, not shipping your page content off to some cloud endpoint.

#Firefox #Mozilla #AI #InfoSec #Privacy #Fediverse #OpenWeb

You're paying AI companies a monthly subscription fee to be fingerprinted like a parolee.

I got bored and ran uBlock across Claude, ChatGPT, and Gemini simultaneously.

Claude:

• Six parallel telemetry pipelines.
• A tracking GIF with 40 browser fingerprint data points baked into the URL, routed through a CDN proxy alias specifically to make it harder to block.
• Intercom running a persistent WebSocket whether you use it or not.
• Honeycomb distributed tracing on a chat UI because apparently your conversation needs the same observability stack as a payments microservice.

ChatGPT:

• proxies telemetry through their own backend to hide the Datadog destination URL from blockers.
• uBlock had to deploy scriptlet injection — actual JS injected into the page to intercept fetch() at the API level — because a network rule wasn't enough.
• Also ships your usage data to Google Analytics. OpenAI. To Google. You cannot make this up.
• Also runs a proof-of-work challenge before you're allowed to type anything.

Gemini:

• play.google.com/log getting hammered with your full session behavior, authenticated with three SAPISIDHASH token variants, piped directly into the Google identity supergraph that correlates everything you've ever done across every Google product since 2004.
• Also creates a Web App Activity record in your Google account timeline. Also has "ads" in one of the telemetry endpoint subdomains.

When uBlock blocks Gemini's requests, the JS exceptions bubble up and Gemini dutifully tries to POST the error details back to Google. uBlock blocks that too. The error messages contain the internal codenames for every upsell popup that failed to load.

KETCHUP_DISCOVERY_CARD.
MUSTARD_DISCOVERY_CARD.
MAYO_DISCOVERY_CARD.

Google named their subscription upsell popups after condiments and I found out because their error handler snitched on them.

All three of these products cost money.
One of them is also running ad infrastructure.

Touch grass. Install @ublockorigin

#infosec #privacy #selfhosted #foss #surveillance