Bundling Pocket, resetting default search provider back to Google on updates. Just a couple off the top of my head.

I'm a long-time Firefox user, FWIW.

> Bundling Pocket

Why is that a problem? I never got the furore over it. When it appeared, I removed the icon and just went about my business.

Annoying yes, but certainly not "shady". From what I understood / stand it was a mozilla app they included with the browser, not that different to how firefox comes with a bookmarks app.

It should be mentioned that it also adds articles to your new tab page, which is possible to remove but not easy for most people.

> it also adds articles to your new tab page, which is possible to remove but not easy for most people

It's two clicks.

Yes, if you're familiar enough with Firefox that you know where to click and are comfortable enough to experiment with customizing your browser. I don't think that's the case for most people.

It took me a few months before I realized that the page was customizable at all, especially since the triple-dot menu doesn't even show up until you hover or focus the element.

Originally it was a proprietary program from a for-profit company. That's why people got upset.

The server component is still proprietary and closed source, at least the last time I checked.

I use DuckDuckGo as my default search engine and it has never reverted back to Google. Perhaps it only happens on certain major updates??

Have also been using it for about a year on linux stable FF, never had it reset.

Yeah, bundling Pocket is not good, but if you don't use it I guess you're not being tracked? Or is there proof that it sends your info either way?

> resetting default search provider back to Google on updates Never happened to me. Was this a specific update I might have missed?

How about enabling DNS-over-HTTPS, which routes your entire browsing history to a third party, based on selections labelled "OK, Got It" and "Disable Protection":

https://github.com/mozilla/doh-rollout/issues/125

Don't get me wrong, DoH is great if you have a shady ISP. But it should be opt-in, not opt-out, since those of us who don't have shady ISPs don't want all our DNS queries centralized in the same place, to be scooped up with just one FISA warrant. And dark patterns like this are a pox on the web and Mozilla shouldn't be perpetuating them.

Your complaint is about a Web Extension Experiment that they're currently testing and not a feature they have shipped in the browser. It seems like this isn't shady at all, but rather they're testing something and soliciting feedback. You provided some and they responded that they plan to write a blog post about it.

So what's shady here? That the process is working?

My understanding is that this is how it's being rolled out, eventually to 100% of users:

https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...

I still don't think its shady. Mozilla have publicly stated that its possible to change the DOH provider, and furthermore they have clearly laid out their requirements for Cloudflare to participate in this experiment. This seems like a good compromise in order to force other providers to start encrypting dns requests.

> since those of us who don't have shady ISPs don't want all our DNS queries centralized

If you live in the US or EU your ISP logs dns queries and sells them on [0] encryption is the only solution.

[0] https://www.ispreview.co.uk/index.php/2019/04/big-uk-broadba...

"OK, Got It" and "Disable Protection" is pretty accurate.

It's inconvenient, but it turns out the "open, anonymous" web has huge trust issues that bad actors use to exploit and attack the unknowing. Some of that is most readily solved by nudging users to trusted third-parties.

You can have issue with whether that third party should be trusted, but the larger issue is that the user has to trust some third party for DNS to work at all, and most don't even think twice about that question.

> since those of us who don't have shady ISPs don't want all our DNS queries centralized

If you don't hae a shady ISP, disable protection. You're already protected by your ISP not being shady, right? ;) The average user has no idea if they should trust their ISP's DNS.

For their release in the US it's assumed that your ISP is shady.