Are you sure? Here is what "recommended by pocket", which automatically appeared recently, shows for me [edit: this is non-personalized as mentioned in a comment]:

"buzzfeednews: Teachers are moonlighting as instagram influencers to make ends meet" trending

"vox: a history of happiness explains why capitalism makes us feel empty inside" trending

"theguardian: chanel shoes, but no salary: how one woman exposed the scandal of the french fashion industry" trending

I have never visited those pages before. I had clean new tab pages showing only most commonly visited pages before, and suddenly automatically this stuff appeared in it now. I consider this spam, yes.

Also, for most commonly visited pages, all it gives me is an orange square with only an "R" in it for reddit or a green square with an "N" in it for hacker news, but for the spammy stuff above it gives full titles!

"Recommended by Pocket" is not "Highlights". Yes, I do disable the "recommended" stuff.

When I enable "Highlights" on the new tab page, I see pages I spent a lot of time on lately: e.g. OpenWRT recommended hardware page, Coney Island water temperature page, and a page about the Graphwiz format. None of them are related to anything in Pocket (which I also actively use), or, thank goodness, buzzfeed.

I disable absolutely everything on the home page/new tabs.

My home page is ~/home.html in all browsers. Thus it's the same in Chrome, FF, w3m, whatever. Much easier than remembering how to set bookmarks/favorites in different browsers and keep them all in sync.

Last time I checked, loading local files as a new tab page required either installing a third party add-on/extension or creating your own[0] in both Firefox and Chrome.

Is that still the case? Did you find an easier option?

[0] Way easier than one would assume, you just need a manifest file next to your HTML file.

EDIT: A local web server instead of loading the HTML file directly also works and avoids the need for add-ons/extensions.

Well that can't be very personalised - those 4 links are exactly what I'm getting too!

I don't think it gets personalized unless you "login" to the your firefox account.

Which account, as I've documented before, is insecure; you should not have a Firefox account and should not store passwords, browsing history, bookmarks or any other privacy- or security-related data with Mozilla's system.

(short version: Mozilla can target you with a small piece of JavaScript to steal your password, then use it offline to decrypt your data)

I remember tour comment at the time, but cannot find it right now.

Do we know if Mozilla is planning anything to fix this?

> Do we know if Mozilla is planning anything to fix this?

Nope, so far as I can tell they are invested in their current approach. In fairness, I will admit that it trades security in order to get a slight improvement in usability.

If they'd just make it impossible to log in via JavaScript, and only through the browser UI, then they could increase the security. But they won't do it.

source/explanation?

Firefox Accounts encrypt user data with (a function of) a master key; that master key is encrypted with a key derived from the user's Firefox Account password. It would be completely insecure for Mozilla to know the user's password (because then they would be able to use the password to decrypt the master key & the master key to decrypt each private datum), so they have set up a protocol in which the user enters his password in his browser, and the browser performs some one-way operations on the password to authenticate. Sounds secure, right?

The problem is that this happens in JavaScript which is downloaded from Mozilla's site. It would be trivial for Mozilla to target a single user with a piece of JavaScript which boils down to:

   if (username === 'target') { sendPlaintextPassword(); }

The solution is for user login to be impossible through web pages, and only available via the browser UI. This would mean third parties would have the opportunity to audit the Firefox source code (e.g. Debian, Red Hat and other distros could check to see if the source they build is malicious). It would also mean that silently targetting a single user would be far less possible (they could still try to send that user a malicious browser if he automatically installs updates — but a security-conscious user gets his updates from a distro, not from Mozilla directly).

It's a really nasty flaw, and the fact that they refuse to address it worries me: why don't they care about the security of their users? Why do they insist on maintaining a backdoor?

>why don't they care about the security of their users? Why do they insist on maintaining a backdoor?

did you report this to them? if there was a bug report and they marked it as WONTFIX or something that would give more credence to your theory. otherwise, Hanlon's razor.

You're right: Firefox is showing you these even though you didn't visit them. Sadly, many of these "recommendations" are from politically charged sites. Vox is notoriously far-left, Buzzfeed is leftist and often features sensational, click-bait headlines.

Disappointed these are showing up on my Firefox homepage.

I have disabled all the Pocket stuff on my Firefox so I didn't see this, but it does not surprise me (even though it disappoints me) that the Mozilla Corporation is using the Firefox home page to push left-wing news.

What's the left-wing news that they are posting?

What a progressive company from Mountain View, CA, would be sticking to? I believe it's sort of hard to be right-wing in a place like that, at least publicly.

I also suppose that this may be the default for a particular audience / geolocation. That is, maybe they'd show a different thing in Russia (sorry, I don't have a Russian VPN), and maybe even a different thing in Texas. Or maybe something based on your previous browsing history (e.g. if you read something like zerohedge a lot, they might show you a different, more aligned site).

I don't know, and am not inclined to thoroughly experiment. But the complete source is there, and it must be a relatively recent addition, so anybody interested could just dive in and find out. Yay Mozilla!

First, they could be sticking to neutral news. Those exist.

Second, I don't believe the source code of the algorithm that picks which news to show you is available... If there's an algorithm at all, because chances are it's curated by humans.

Neutral news? I'd appreciate a few examples (unless it's the paid news agencies feeds).

The closest thing to that is trying to go back 30 years ago. Find sources that are not sensationalizing the news. That's the best indicator IMO for "news". Meaning, things that are happening, not what people are saying or doing (what Trump or someone else is saying etc).

My recommendations for this are the BBC RSS feed, PBS NewsHour for nightly news / video (Youtube or OTA antenna) and a local paper RSS feed (Chicago Tribune for me). Though that paper has long been considered politically biased (to the right), local events are probably more important than national or worldwide news coverage so one has to bite the bullet at a point.

BBC/Tribune/PBS are simply exceptional reporting, regardless of any leanings, and I'd put that ahead of worrying about a lack of total neutrality. It's a little overblown. It's been clear for some time now that there's a bit of a struggle for right-wingers on being able to mentally muster their way through biased reporting (real or perceived). There's a lot of weak and fragile people around today, can't even watch or read something that doesn't cater to their sensitivities. It used to be that a right-winger aspired to be John Wayne. Now they're all-in on victimhood culture. If they did anything in their life at all, like get off the couch to join the military (which is a government dependent of the worst kind- one that leads to people getting killed, rather than an unpaid, sacrificial service), they're deeply offended if you're not constantly kissing the ring.

Maybe checking just the AP releases would be the best way to get "neutral news", but I think if you just hunt for sources that explicitly do not sensationalize the news, something Fox News brought into popularity, you'll get most of the way there.

Many news agencies have free content as well.