DEV Community: mozilla

Most big Firefox add-ons still don't say what they collect

Iain — Fri, 23 Oct 2026 13:52:54 +0000

Here's what Firefox showed me this morning when I went to install two password managers:

Bitwarden 2026.10.0, out on 15 October

LastPass 4.154.2

Which one's telling you more? LastPass, obviously. It's got a whole "Required data collection" section, and a pre-ticked box for sending the developer technical data. Bitwarden's just stops after the permissions, and it'd be easy to read that as "collects nothing".

But, that's not what this actually means.. An add-on that really collects nothing will say so in the prompt - Proton Pass's says "The developer says this extension doesn't require data collection." Bitwarden's has no data section at all, since nobody's made Bitwarden fill it in.

Since 3 November 2025, every new add-on on addons.mozilla.org (AMO) has had to put a data_collection_permissions key in its manifest, even if it's only to say "none", and Firefox 140+ shows it in that prompt. Add-ons that already existed were let off, but Mozilla said that wouldn't last:

In the first half of 2026, Mozilla will require all extensions to adopt this framework. But don't worry, we'll give plenty of notice via the add-ons blog.

The first half of 2026 ended in June. The add-ons blog hasn't mentioned it since, and nothing's changed. AMO's API reports the key for every add-on, so I went through the top 1,000 by users to see how far the labels have actually got.

Updated since July, and still nothing

Of the top 1,000, 776 show nothing. Most of those haven't shipped a new version since November, so they never had a reason to add the key. The 21 made since November are fine, 20 of them declare something, which is what happens when it's actually enforced. So I split the other 979 by when their current version was uploaded:

Current version uploaded	Says something
Before 3 Nov 2025	2 of 475 (0.4%)
3 Nov 2025 to 30 Jun 2026	57 of 161 (35%)
Since 1 Jul 2026	145 of 343 (42%)

Adblock Plus, AdGuard, Dark Reader, DuckDuckGo, Ghostery, NoScript, 1Password, MetaMask and Bitwarden have all shipped since July, and none of them say anything. I downloaded each one to check the API wasn't lying, and the key just isn't in their manifests. They're 9 of the 198 in that last row that left it out, and those 198 have about a third of the top 1,000's daily users between them.

That's Mozilla's deadline, not theirs. Nobody told them to add it (more on that next), and silent doesn't mean they're collecting anything. uBlock Origin and Privacy Badger both bothered to say "none". It just means the prompt can't tell you either way.

Nothing makes them

Why haven't they? Mostly beacuse they don't have to. AMO's upload check upload check only turns a missing key into an error when it's a brand new add-on uploaded through the developer hub. An update gets a warning, and that warning still says the key "will be required for new versions of existing extensions in the future". Mozilla's docs say older add-ons "will have to at a later date", with no date.

The nearest thing to news is a reply from Mozilla's add-ons team on thier forum, on 10 September:

Even though we haven't retroactively asked all the published Add-ons to comply with this policy, we do it every time they submit a new version/update.

From the code, I think "asking" there is that warning. The same reply says "I can't promise anything specific right now".

Being honest costs you

When an older add-on adds the key for the first time and says it collects something, every existing user gets asked to agree, and if they say no the update doesn't install. Saying "none" doesn't do that. Firefox has a way round it: a has_previous_consent flag that says users already agreed to whatever the add-on did before, so the update goes through without a prompt. But AMO's linter has rejected that flag since October 2025, in a change titled "Prevent the use of has_previous_consent for now".

Return YouTube Dislike found out what that means. It's got about 900,000 daily users, and on 7 September it shipped its first update in nearly two years, declaring personally identifying information, browsing activity, website content and website activity. Its developer says all it gets is a random user ID and the IDs of the videos, which is how it counts dislikes in the first place. That sounds like a lot for a dislike button, but Mozilla's examples for personally identifying information include "ID numbers", and browsing activity covers even "domains", so I can see how it got there. Here's what happened on its reviews page:

One-star reviews of Return YouTube Dislike on AMO (the data)

A week at a time, from Mondays, up to 11 October. Version 4.0.6 came out on 7 September

It went from about one a week to 101 in a week. "Spyware", "data mining scam", "At what point does a youtube dislike add-on need my personal data?". One reviewer was sure the developer's account had been hacked. My favourite was this one, which sort of gets it and still gives one star:

The fact that the data processing method hasn't changed means it was being collected all along.

To be fair to the reviewers, the same update added premium statistics (likes over time, maps by country), and some of the reviews are about that. But about half of the 224 one-star reviews since 7 September mention the data or the permissions, some quoting Firefox's prompt word for word. The developer put it on Mozilla's forum as "calling my reviews section a shitstorm is an understatement".

The first post in that same thread is from SponsorBlock's developer. It's a similar sort of add-on, talking to its own server about YouTube videos, and they were working out which boxes they'd have to tick. Probably browsing activity, they thought, maybe website content. SponsorBlock's current version came out in July and doesn't declare anything, so its 820,000 daily users get a nice clean prompt.

So nothing makes the quiet add-ons say anything, and the flag that would let the honest ones say it without a fight has been blocked by AMO "for now" for a year. Untill one of those changes, the add-ons that tell you the most look the worst, and the ones that tell you nothing look fine.

Firefox: New security update protects against fake websites

Hacks.gr — Wed, 21 Oct 2026 02:51:38 +0000

Mozilla has released Firefox 158.0.1, addressing the compromise of eight eMudhra digital certificates.

This update ensures that the certificate revocations, previously managed via OneCRL, are fully enforced, protecting users who have disabled automatic updates.

Beyond security, the release includes fixes for VPN activation, JPEG XL transparency, and display issues on Linux.

Protection against counterfeit certificates

The most serious issue addressed by the new version concerns the revocation of eight digital certificates from the eMudhra authority. Digital certificates act as identities that confirm that a website is indeed who it claims to be.

Because the digital keys for these certificates were exposed, third parties could potentially use them to spoof websites. Mozilla had already revoked these certificates on October 17th through a mechanism that automatically updates in the background. With the new version, the revocation is built directly into the browser, offering additional protection even for users who have disabled automatic security updates.

Additional improvements

The update also resolves several issues that some users may have noticed:

Mozilla accuses Microsoft of pressuring users to install Edge

Hacks.gr — Sat, 17 Oct 2026 14:30:30 +0000

Mozilla's 87-page report details how Microsoft uses dark patterns and system prompts to prioritize the Edge browser on Windows 11, highlighting the impact of regional regulations on platform defaults.

According to a Mozilla executive, the company is doing everything it can to comply with laws surrounding user choice. The organization published a massive 87-page report documenting how Windows aggressively promotes Edge. For example, after a system update, a window often appears prompting users to complete their computer setup. There is a default setting there that, if not checked, automatically makes Edge the default browser for browsing the web.

The situation in Europe and Mozilla's demands

These practices are not seen in Europe, as European laws force Microsoft to be more respectful of citizens' choices. In European countries, the Start menu opens links in the user's designated program rather than Edge. Mozilla is asking Microsoft to bring this European version of Windows to the rest of the world, although it believes that doing so will require government intervention.

The organization also says it frequently receives complaints from Firefox users who are confused because their bookmarks have disappeared after Windows changed their default browser to Edge.

The bigger picture in technology

Mozilla points out that Microsoft is not alone, as Apple and Google are equally aggressively promoting their own programs and services on their own operating systems.

Finally, he reminded that Mozilla's revenue comes primarily from its agreement with Google, which pays to be the default search engine in Firefox.

Hacks.gr on Google

Set it as a preferred source for cybersecurity updates.

Preferred source

Read the original English article on Hacks.gr

How to stop worrying about protecting your data

Hacks.gr — Sat, 17 Oct 2026 12:22:26 +0000

Explore six practical strategies to combat privacy fatigue, featuring expert insights from industry leaders on tracker blocking, permission audits, browser choices, and reducing digital footprints.

The fatigue of constant decisions

Constantly being asked questions every time someone visits a new website, downloads a file, or creates an account creates a lot of mental fatigue. Jason Ng from the OpenVPN team notes that fatigue comes from constantly having to make choices and suggests saving our attention for the few important things, like which apps are sharing our data. Chris Wallis, founder of Intruder, emphasizes that when notifications inundate users, the most serious risks risk getting lost in the noise. For this reason, using automated tools helps significantly.

For her part, Cylab professor Lorrie Cranor says that a level of fatigue may be inevitable, but she relies on out-of-the-box tools like browser extensions and search engines that protect privacy. She also suggests a simple rule: when presented with a data option, always choose the setting that protects the most privacy, unless you find that a necessary feature is not working. Mozilla’s Neha Kochar points out that choosing companies that collect less data from the start drastically reduces the number of everyday decisions. Kochar herself almost fell victim to a scam message pretending to be a hotel and asking for confirmation of a booking, after data was leaked to a third-party company.

Six simple ways to reduce fatigue

Maintaining privacy doesn't require disappearing from the internet. Automating choices reduces digital workload through six practices:

Setting up a tracking blocker: Adding a tool, such as Ghostery, DuckDuckGo, Brave, Privacy Badger, or DuckDuckGo Privacy Essentials, instantly stops advertisers from tracking your browsing history.
Change browser: Using a program that protects privacy up front fills significant gaps in daily monitoring.
Check app permissions: Most apps don't need to know your location or access your contacts. Restricting permissions keeps your device safe.
Reject cookies: As a general rule, disabling unnecessary logs on websites usually does not affect their functionality.
Cleaning up social media accounts: Removing personal information from profiles, deleting inactive accounts, and limiting access to friends only limit exposure.
Block unwanted calls: Most mobile phone providers have settings to filter calls from strangers, preventing the inadvertent sharing of voice and personal information with scammers.

Hacks.gr on Google

Set it as a preferred source for cybersecurity updates.

Preferred source

Read the original English article on Hacks.gr

Thunderbird 158 released with major fixes and faster search

Hacks.gr — Wed, 14 Oct 2026 00:11:37 +0000

Mozilla released Thunderbird version 158 for Linux, Windows, and macOS, bringing key stability and synchronization improvements.

The update addresses a message body search crash, improves Quick Filter responsiveness, and ensures unaccented name searches match accented equivalents.

It also includes OpenPGP fixes for key unlocking and resource leaks, alongside a Linux-specific fix for SMTP Kerberos authentication failures when STARTTLS is enabled.

What changes in daily use

The new version improves the speed and responsiveness of the built-in quick message filtering tool. In addition, it fixes an issue when searching for names, so that they are correctly detected even if they do not contain accents or other special characters.

Several fixes address everyday issues that users have encountered. For example, long-pressing the keys to send a message no longer causes an unintentional double send. We also fixed a bug that caused the app to crash when searching within message text.

Fixes for encryption and synchronization

Users who use encryption tools will see fixes to issues with unlocking keys, resource management, and key protection. A bug that prevented copying backup passwords has also been fixed, as well as an issue that caused options menus to appear transparent.

In the area of contact and calendar synchronization, the update resolves issues where saved passwords were lost after restarting the application.

Specific improvements for Linux and other services

Linux users get a fix for a login authentication issue when this security precaution is enabled. In addition, the update fixes several other issues, including:

Accounts no longer constantly display login errors when the app starts in an offline state.
Issues filtering updates that were losing their labels and raw data.
Service connection crashes when saving login credentials was disabled.
System administrators using certain settings can now install add-ons using an update address, if no other installation address is specified.

How will you receive the update?

Thunderbird version 158 is available for Linux, Windows, and macOS.

Read the original English article on Hacks.gr

Mozilla introduces Firefox Enterprise for centralized management in businesses

Hacks.gr — Tue, 13 Oct 2026 07:33:32 +0000

Mozilla has announced Firefox Enterprise, combining the browser with a self-hosted management console for organizations.

IT departments can locally manage browser policies, security controls, extension permissions, and AI governance without external providers.

How management works

Unlike other services that rely on external providers, the new offering combines the familiar browser with a management console that organizations can host on their own computers and servers. This allows IT departments to configure rules, access rights, and security settings without relying on third parties.

According to Mozilla, this decision comes at a time of increasing European interest in reducing reliance on a few large technology providers. Although there were already capabilities for corporate use, the new service offers a complete commercial platform and additional security tools.

Security and control capabilities

Administrators can centrally control policies on devices, manage usage data, and leverage built-in protection to prevent sensitive information from leaking. Specifically, the platform allows administrators to warn users or block data sending actions based on the destination website.

Features include:

Artificial intelligence control: Organizations can allow, restrict, or disable the use of artificial intelligence tools according to their internal rules.
Connection to security systems: Security teams can export browser events to the company's central logging systems.
Increased protection mode: A special environment for high-risk situations.
Add-on management: Control which additional programs employees are allowed to install and use.

The service works alongside existing infrastructure, identity recognition systems and device management programs that companies already use.

Support and next steps

The offer includes professional support directly from Mozilla, which features private issue management and defined response times. This support can also be purchased separately for businesses using the classic version of the program.

The service is initially available in Europe, specifically in France, Germany, Austria and Switzerland, and is expected to expand to other markets in the future. Mozilla is also working on a similar service for its email application, which will allow for centralized management of messages, calendars and contacts, but no release date has been announced yet.

Read the original English article on Hacks.gr

Firefox 158 released with native support for JPEG XL images

Hacks.gr — Mon, 12 Oct 2026 15:49:29 +0000

Mozilla released Firefox 158 with native JPEG XL image support, sub-pixel scrolling accuracy, and SkPDF integration for PDF generation on Linux and macOS.

The release also includes Android tab bar customization and a fix for WebSocket message tracking in the Network Monitor.

The most significant change is the built-in support for JPEG XL images. The new image format offers better compression, supports transparency, animation, and high dynamic range, and also allows conversion of older JPEG files. Users can now view such images directly in the browser, without the need for additional settings.

Better PDF management and smoother scrolling

The new version changes the way PDF files are created on Linux and macOS computers, making documents more accessible and improving their appearance.

At the same time, scrolling on web pages is now more precise, as the limitation that limited movements to whole pixels has been removed. This is especially helpful on high-resolution screens and when the user is zooming.

New personalization options and conveniences

On the new tab page, the browser now stores a collection of previous wallpapers in the “Your images” section so they are easily accessible.

When it comes to filling out forms, the browser can suggest relevant information from open tabs and saved data. Mozilla clarifies, however, that this feature is being gradually rolled out to users.

On Android, users can now choose whether the tab bar is at the top or bottom of the screen through the personalization settings. On Windows, menus work better with high-contrast themes, allowing control over background and text colors. Finally, an issue in developer tools where network monitoring was missing messages that arrived immediately after a connection was established has been fixed.

Read the original English article on Hacks.gr

Firefox 158 now available with built-in support for JPEG XL images

Hacks.gr — Mon, 12 Oct 2026 15:41:33 +0000

Firefox 158 is out with native JPEG XL image support, CSS typed arithmetic in calc, WebAuthn conditional UI updates, and navigation options for notifications.

This image format supports wider color gamut, high dynamic range, video and animation, as well as options for high-quality lossless images and progressive loading. Mozilla has been testing this feature for several months, initially allowing users to enable it in a trial version through a special settings page.

New features and improvements

The program's artificial intelligence feature for navigation can now automatically fill in fields in forms by drawing information from other open tabs or from saved fill-in data.

In the area of privacy-friendly local translations, support for three new languages has been added: Albanian, Belarusian, and Filipino. A display issue with small icons on web pages when using the Ubuntu operating system has also been fixed.

Creating PDFs within the program now produces more accessible documents, and display issues that caused mathematical symbols to disappear have been resolved. Scrolling through web pages is smoother and more accurate, as the program no longer rounds scroll positions to the exact pixels of the screen.

On the new tab page, custom wallpapers that users have been using are now grouped into a separate images folder. The new version also includes changes for web developers, as well as a number of security fixes.

Availability and update

Installers are available from Monday, October 12th via Mozilla's archive service. Automatic updates for existing Windows, macOS, and Linux users began rolling out on Tuesday, October 13th, with Linux distribution repositories and app stores expected to roll out gradually thereafter.

Read the original English article on Hacks.gr

Mozilla Measured the Open-Weight Gap: 5 Points, 8 of 10, 4% of Revenue

Khasky — Tue, 22 Sep 2026 07:09:11 +0000

Four datasets went into Mozilla's State of Open Source AI report. A developer survey fielded with SlashData, OpenRouter's traffic panels, Epoch's Capabilities Index, and METR's time-horizon data. Read separately they support the usual arguments. Read together they describe open-weight models that are close on capability, ahead on routed traffic, and nearly absent from the revenue.

The measurements

The three measurements the report rests on, with the window each one was taken in.

Epoch Capabilities Index, September 1 data
Claude Fable 5, Claude Opus 5 (closed)     162
Kimi K3 (open)                             157
gap                                        5 points
Epoch's average gap since January          8 points (90% CI 7-11)
in calendar time                           about 4 months (Epoch), about 4.4 months (Mozilla, from METR data)

OpenRouter, August 1-31, token volume
open weights in the top 10                 8 of 10
Chinese-built among those 8                7
first open model to lead weekly requests   DeepSeek, from August 3, after Google's 51 weeks at #1

OpenRouter, May-September 2025, model layer
usage      open ~20%    closed ~80%
revenue    open ~4%     closed ~96%
price      closed about 6x per call, at about 90% capability parity

The traffic figures count routed OpenRouter requests only, first-party use inside ChatGPT, Gemini and Doubao sits outside them, and the revenue split is the last one published, from a window the report says usage has since moved past.

Why a 5-point gap and a 4-month gap are the same fact

The 5 points on the September chart run under Epoch's own average of 8 since January, and that average is what Epoch converts into roughly four months of calendar lead.

Mozilla ran the conversion a second way, fitting METR's raw time-horizon data, and got about 4.4 months, with open capability doubling every 3.9 months against 5.5 for closed. The report labels its own fit a simplified reproduction rather than a result. 📐

Release timing keeps the number stable. Every model on the chart shipped between June and August, so the margin is redrawn each cycle instead of compounding across them.

Usage on OpenRouter

DeepSeek's V4 Flash 0731 led the August token table at 45.1 trillion tokens, DeepSeek held three of the top ten places, and only three US entries made the list at all. On requests rather than tokens, August 3 was the first day an open model took the top spot, and DeepSeek covered the distance from third to first in eight weeks.

What the numbers do not cover

Taking the limits before the economics is deliberate, because the revenue figure below is the one most likely to be quoted without them.

Routed traffic is not all traffic. Anything served first-party inside ChatGPT, Gemini or Doubao never appears in OpenRouter's panels, which leaves a large share of real usage outside every figure here.

The revenue split is older still. It covers May to September 2025 and has not been re-measured, and the report states that directly: usage has moved since that window, and the 4% is simply the last figure published.

The measured gap is a floor. Epoch gives two reasons it may be understated: open models optimize on benchmarks more aggressively, and unpublished closed models are absent from the baseline.

The economics

The report's own reading of the revenue table is one clause long: capability is near parity, and price drives the split. Among developers who choose open models, 30% name lower cost as a top reason and 28% name privacy, and the Linux Foundation's estimate of unrealized annual savings from that asymmetry is $24.8B.

Where open stalls

79% of surveyed developers use open models, yet 51% of open deployments reach production against 63% for closed, a gap the survey traces to tooling and trust rather than capability.

firms using open components            89%
developers using open models           79%
open models reaching production        51%
closed models reaching production      63%

One figure underneath it carries the section. Vendor-partnered deployments reach production 67% of the time and internal builds 33%.

Capability without pretraining

DeepSeek's July 31 post-training pass lifted V4-Flash 10 points on the Artificial Analysis index on an unchanged architecture, and the August 13 pass added 8 to V4-Pro, with no new pretraining run behind either.

V4-Flash-0731   Jul 31   AA index ~40 -> ~50   +10   post-training pass, same architecture
V4-Pro-0813     Aug 13   AA index 45 -> 53     +8    post-training pass, two weeks later

The V4-Flash pass moved Terminal-Bench 2.1 from 61.8 to 82.7 and cut eval-suite output tokens from 234M to 206M, so the score did not come from longer answers. Post-training costs a fraction of pretraining, which puts this kind of gain inside reach of anyone with an open base and a budget. 🔁

Any targeted use of another model's outputs would also happen in post-training, so the report treats the cheap-gains question and the provenance question as one.

Report page: https://stateofopensource.ai
Full PDF, v1.1: https://stateofopensource.ai/state-of-open-source-ai-v1-1.pdf

Follow me for more on AI and Software Development:

khasky — LinkedIn / GitHub / Patreon / Bluesky / Mastodon / Medium / Devto

khaskydev — X / Threads / Instagram / Pinterest / Tumblr / Facebook / VK

Firefox Smart Window’s Mistral option is hosted AI, not local inference

Breach Protocol — Thu, 17 Sep 2026 06:12:29 +0000

Firefox Smart Window is an opt-in browser mode that sends context-aware assistant prompts through Mozilla to hosted providers, including Mistral Small 4 hosted by Mistral AI. It matters because the product's privacy claim is about proxying, controls and retention practices—not the stronger claim that the named Mistral model runs locally in Firefox. Mozilla's own documentation makes that distinction clear.

Key facts

Smart Window is a distinct, optional Firefox window type.
Firefox's model page lists Mistral Small 4 as hosted by Mistral AI.
A local classifier routes a request as chat or search, while the substantive prompt goes to Mozilla and then a provider.
The primary source is Mozilla's Smart Window guide.

Smart Window can summarize pages, compare tabs, help plan work, retrieve history a user asks it to consider, group tabs and use Exa for current web results with sources. It cannot click arbitrary site controls, complete forms, make purchases, change browser settings, sign in with stored credentials or act on its own. The division is closer to a research assistant with access to a folder of pages than to a web-operating agent.

Mozilla's privacy notice explains the route. The browser first uses an on-device intent model to decide whether the Smart Bar entry is a chat or search request. For a chat, relevant page titles, URLs, explicitly selected pages and optional Memories may be sent to Mozilla; Mozilla forwards the request to the chosen third-party model. The provider sees Mozilla's request rather than the user's IP. Mozilla says it does not train models on Smart Window interactions, and it says chats and Memories are stored in Firefox's interface or locally on device, subject to the stated controls.

The nuance is that local storage does not equal local inference. Mozilla's model-choice page labels Mistral Small 4 “Personalized” and identifies its maker and host. Mistral describes Small 4 as an open-weight 119B-total-parameter mixture-of-experts model with a 256k context window, but Firefox does not download it by default. Do not infer a local disk download or a run-time VRAM requirement from its parameter count; Mozilla's default route is hosted. Users who want local inference can configure an OpenAI-compatible endpoint such as Ollama or Lemonade via Mozilla's bring-your-own-model documentation.

Mozilla calls Smart Window “optional and opt-in.” The rollout started in English in the United States and Canada and has a French beta in France; the companies say the United Kingdom and Germany are expected later in 2026. Memories are optional, stored locally after generation, and can draw from up to 60 days or 3,000 history items initially. Private-window activity is excluded.

The strongest criticism, prominent in the Hacker News discussion, is that calling the product private can mislead users who reasonably hear “private” as “my browsing context never leaves the device.” The strongest defense is equally concrete: a capable hosted model is practical for far more computers, and Mozilla offers model choice, proxying, local Memories and a self-hosted escape hatch.

The honest conclusion is neither that Smart Window is secretly local nor that privacy controls are meaningless. It is a browser-mediated cloud AI product with a local router, explicit consent surfaces and bounded browser actions. The user-facing test is simple: decide whether the convenience of contextual hosted assistance is worth transmitting the selected context under Mozilla's stated terms.

Originally published on Ground Truth, where every claim is checked against the primary source.

In-Depth Analysis: Mozilla's Built-In Ad Blocker f…

Norvik Tech — Fri, 04 Sep 2026 01:05:55 +0000

Originally published at norvik.tech

Introduction

Explore the technical details and implications of Mozilla's new ad blocker in Firefox for iOS, leveraging Apple's WebKit API.

Understanding Mozilla's Built-In Ad Blocker

Mozilla has integrated a built-in ad blocker into Firefox for iOS, utilizing Apple’s WebKit API. This marks a significant step in browser functionality, particularly given that no competing engines have successfully implemented similar features since the Digital Markets Act (DMA) introduced it two and a half years ago. The primary function of this ad blocker is to enhance user experience by preventing unwanted ads from loading, thereby improving page speed and overall performance.

In the first third of our analysis, it's essential to note that Mozilla's decision to leverage WebKit API not only adheres to Apple's ecosystem but also ensures compatibility with existing iOS applications. WebKit, being the underlying engine for Safari, provides a robust framework that allows developers to implement content blockers efficiently. This integration supports a smoother user experience across various web applications, resulting in reduced load times and better overall performance.

[INTERNAL:web-development|Understanding browser engines]

Key Mechanisms of the Ad Blocker

Utilizes WebKit's content blocking capabilities
Filters requests based on user-defined preferences
Supports multiple ad types including banners, pop-ups, and tracking scripts

The Architecture Behind the Ad Blocking Feature

How It Works

The architecture of Mozilla's ad blocker consists of several key components that work in concert to enhance browsing efficiency:

Request Filtering: The ad blocker intercepts network requests before they reach the page renderer. By applying predefined rules based on user settings or Mozilla's criteria, it determines whether to block or allow each request.
User Preferences: Users can customize their blocking preferences, allowing them to select which types of ads or trackers they wish to block.
Performance Metrics: Mozilla likely integrates metrics to measure the impact of the ad blocker on page load times and overall user satisfaction.

Comparison with Other Technologies

While other browsers have implemented ad blocking features, Mozilla's approach stands out due to its integration with WebKit. For instance:

Chrome uses its own set of rules for ad blocking, which are less flexible than Mozilla’s user-driven model.
Brave focuses heavily on privacy but may not integrate as seamlessly within the iOS ecosystem as Firefox does with WebKit.

Why This Matters: The Impact on Web Development

Importance of Ad Blocking in Modern Browsing

The introduction of an integrated ad blocker in Firefox for iOS has significant implications for web development. Firstly, it sets a precedent for user experience expectations across platforms. Developers are now tasked with creating websites that not only deliver content effectively but also respect user choices regarding ads.

Real-World Implications

Performance Optimization: Websites may need to adopt more sophisticated performance optimization techniques to ensure they load efficiently even when ads are blocked.
Ad Revenue Models: Companies relying on ad revenue must rethink their strategies. With more users opting for ad blockers, alternative monetization methods such as subscriptions or premium content may become necessary.
Industry Standards: As more browsers adopt similar features, we may see a shift towards more ethical advertising practices that prioritize user engagement over intrusive ads.

When and Where to Implement Ad Blocking Solutions

Use Cases for Businesses

Integrating an ad blocker like Mozilla’s can be beneficial in several contexts:

E-commerce Platforms: Ensuring that product pages load quickly and are free from distractions can improve conversion rates.
News Outlets: Readers often prefer fewer ads when consuming content; implementing an ad blocker can enhance their experience and encourage subscriptions.
Mobile Apps: For mobile app developers, understanding how ad blockers function can lead to more thoughtful integration of ads that respect user preferences.

Industry Applications

This technology can be applied across various industries including:

Retail: Enhancing user experience on e-commerce sites.
Media: Providing an uninterrupted reading experience on news websites.

What Does This Mean for Your Business?

Business Implications in Colombia and Spain

For businesses operating in Colombia and Spain, the deployment of integrated ad blockers like Mozilla's represents a shift in how digital marketing strategies are approached. In these markets, where data privacy concerns are rising, having a built-in solution aligns with consumer expectations for transparency and control over their browsing experience.

Local Market Considerations

Adoption Rates: As mobile usage continues to grow in Latin America, businesses must adapt their strategies to accommodate users who prefer ad-free experiences.
Cost Implications: Implementing solutions that respect user privacy may initially seem costly but can lead to higher retention rates and customer loyalty in the long run.

Next Steps for Your Team

Conclusion and Actionable Insights

As your team evaluates the implications of Mozilla’s built-in ad blocker, consider conducting a pilot study to measure its impact on your web applications. Start by identifying key performance metrics such as load times and user engagement rates without ads. Norvik Tech specializes in supporting teams through this transition by offering tailored development solutions that align with your strategic goals.

Recommended Steps

Identify specific metrics you want to track (e.g., load time improvements).
Conduct A/B testing with and without ads to understand user behavior.
Analyze results and adjust your digital strategy accordingly.

Preguntas frecuentes

¿Cómo afecta el bloqueador de anuncios a la experiencia del usuario?

El bloqueador de anuncios integrado en Firefox mejora significativamente la experiencia del usuario al reducir los tiempos de carga y eliminar contenido intrusivo que puede distraer de la navegación efectiva.

¿Qué industrias pueden beneficiarse más de esta tecnología?

Las industrias de comercio electrónico y medios son las que más se beneficiarán al implementar bloqueadores de anuncios, ya que mejoran la retención de usuarios y optimizan las tasas de conversión.

Need Custom Software Solutions?

Norvik Tech builds high-impact software for businesses:

development
consulting

👉 Visit norvik.tech to schedule a free consultation.

I solved a 5 year old bug

Ifeanyi Chima — Thu, 30 Jul 2026 22:48:44 +0000

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry.

Introduction

Let me start by saying I am an Open-source contributor at Mozilla, I am trying to get better as a software engineer. I will be using the words Site or Tile interchangeably, they mean the same thing.

Bug Report

The title of the bug report was "Cannot remove amazon.com from top sites list" on Bugzilla and I believe it really captures the pain-point that users experienced because of the bug.

In this bug report the user is complaining that he cannot remove amazon.com from Top Sites in the New tab page of his Mozilla Firefox browser.

Background

A little back-story of what Top Sites, New tab page and Places is:

Top Sites is that grid of website shortcuts you see on Firefox's New Tab Page. It shows the sites you visit most often, plus some sponsored tiles (called "spocs," short for sponsored content) that Mozilla partners provide. The image below shows a row of Top Sites on the New Tab page.

New tab page is the page that opens when you open a new tab or click the home button.

Places is a SQLite database that Firefox uses to store browsing history.

The Problem

Imagine you open a new tab in Firefox and see a grid of your most-visited websites (called "Top Sites"). amazon.com keeps showing up there, even though you never visit it and you keep trying to delete it.

You right-click on the Amazon icon, click "Delete from History," but... nothing happens. It just sits there, refusing to leave. You try again. Still there. You try "Dismiss." Still there. It's like a stubborn guest who won't leave your house.

Why This Happens

Firefox's Top Sites can come from three places:

Your actual browsing history (sites you really visited)
Pinned sites (sites you manually pinned to stay there)
Default/curated sites (sites Firefox puts there automatically, like Amazon, because they think you might want them)

Stay with me and we would find out which one of these is the culprit.

Understanding the Bug (Part A)

Investigation:

By reading through the thread on the bug report, I discovered a trick other users on the thread had tried

one user on the thread had the idea of changing the URL and then the problem went away, but after a new firefox release Firefox 82.0 (64-bit) the trick could no longer work.

Reproducing:

To reproduce the bug locally, I had to visit https://amazon.com multiple times (up to 20 times) on my local PC so that I can get amazon.com to show up as a Top Site on my New Tab page.

Reviewer Feedback

My first attempt was to block the url whenever a user clicked "Delete History" so that it will never show up again in Top Sites.

mak (a mozilla engineer) pushed back on this, pointing out that if a user just wants to delete history, silently also blocking the site (removing it entirely from Top Sites without saying so) gives them unexpected behavior.

The problem with the fix is that the dialog asks to the user if they want to remove from history, but then the code proceed also blocking the site, that is not told to the user and may be unexpected.
If the user wanted to effectively just remove history, not block the site, they will get the wrong behavior.

I'm not expert of this code, but it looks like the proposed solution is broad and may cause unexpected behavior, actually removing control from the user rather than increasing it.

It's touching the right problem though, someone should eval a UX solution.

I got a second feedback from another reviewer thecount (a mozilla engineer) and he was the one who led me to the right fix for the bug.

If you log link.url and searchProvider.url, like this console.log(link.url, searchProvider.url);

Right before this line: https://searchfox.org/firefox-main/source/toolkit/modules/NewTabUtils.sys.mjs#1093

And then on startup, I see this in the logs: "https://www.amazon.com/ https://amazon.com".

So this is the line that causes the url to be changed, and now the url is no longer removable because it no longer matches the original places url.
one solution might be to store "originalUrl" link.originalUrl = link.url in the block I linked above, and then when we delete the url, check if we have "originalUrl" and use that instead"? So something like link.originalUrl || link.url.

With this feedback, I was able to finally understand the bug.

Issue

// toolkit/modules/NewTabUtils.sys.mjs

links.forEach(link => {
       let searchProvider = getSearchProvider(NewTabUtils.shortURL(link));
        if (searchProvider) {
          link.url = searchProvider.url; // <= swap is done here
        }
      });

The issue was from here: you see Firefox does a check to see if amazon.com is already stored as a search-shortcut provider and then it quietly drops the url and replaces it with the internal searchProvider.url. This is why when we click "Delete History" nothing happens because we have lost the url that was supposed to match what we have in Places (a database in Firefox).

What is a search-shortcut provider, It means "a site Firefox knows how to search directly", and Amazon qualifies because Amazon has its own product search.

What this means

Before a tile ever reaches the New Tab page, Firefox checks each link against its built-in list of search-shortcut sites (Google, Amazon, Bing, DuckDuckGo, eBay, Twitter, Wikipedia). If the link matches one of these, Firefox swaps that tile's url to a version meant to trigger a search on that site, not to visit the homepage you actually browsed to.

Understanding the Bug (Part B)

Mental model

The mental model to have in Firefox is

Frontend: the New Tab Page (React), shows the tiles, builds the request
The request itself: the payload sent from frontend to backend
Backend: PlacesFeed.sys.mjs, receives the request, touches the actual database (your browsing history)

Like when building a To-do App, when you click on an item to delete from the database, you send the id of the item as a payload to the backend (either in the URL or Request Body). But here, the real id (original_url) was quietly being generated and never forwarded, the frontend only ever knew about url, which by that point pointed to the wrong thing.

So, for the fix we are going to be borrowing heavily from the full-stack MVC architecture

Breaking down the fix

We make sure that we do not lose reference to the url before it gets silently swapped out by Firefox, so we do something like this link.original_url = link.url; here, we are storing away the url in a variable called original_url and it will be referenced later when we want to delete a site.

Allow me to break down the fix using REST API from Nodejs.

A This is like a backend endpoint that serves your frontend a list which we use to create the Tiles. Here is where we create the Top Sites and send to the frontend, but we quietly rename a field along the way.

app.get("/topsites", (req, res) => {
  const items = getLinksFromDatabase();

  const response = items.map(item => {
    const searchProvider = getSearchProvider(item);
    if (searchProvider) {
      return {
        ...item,
        original_url: item.url,      // <=backup the real id/url
        url: searchProvider.url,     // <=overwrite what the frontend will see
      };
    }
    return item;
  });

  res.json(response);
});

B A user clicks a button which fires off a delete request and then we send both the url and original_url to the backend server.

fetch("/api/delete-history", {
  method: "DELETE",
  body: JSON.stringify({
    url: site.url,
    original_url: site.original_url,
  }),
});

C The backend receives the request and decides what to actually delete

app.delete("/api/delete-history", (req, res) => {
  const { url, original_url } = req.body;
  db.deleteEntry(original_url || url);
  res.sendStatus(200);
});

It checks: "do I have an original_url? If yes, use that to delete. If not, fall back to url."

This is important, because if it only used url, it would try to delete the search provider's link instead of the real saved site, and the deletion would silently fail or delete the wrong thing.

The Fix

Finally !!!!, now that we have a solid understanding of the issue and the fix, let us go ahead and implement.

A. Equivalent to Step 1 from the Rest API

// toolkit/modules/NewTabUtils.sys.mjs
links.forEach(link => {
  let searchProvider = getSearchProvider(NewTabUtils.shortURL(link));
  if (searchProvider) {
    link.original_url = link.url;
    link.url = searchProvider.url;
  }
});

B. Equivalent to Step 2 from the Rest API

// browser/extensions/newtab/content-src/lib/link-menu-options.mjs
action: {
  data: {
    onConfirm: [
      ac.AlsoToMain({
        type: at.DELETE_HISTORY_URL,
        data: {
          url: site.url,
          pocket_id: site.pocket_id,
          forceBlock: site.bookmarkGuid,
          original_url: site.original_url,
        },
      }),
    ],
  },
},

C. Equivalent to Step 3 from the Rest API

// browser/extensions/newtab/lib/PlacesFeed.sys.mjs
case at.DELETE_HISTORY_URL: {
  const { url, forceBlock, pocket_id, original_url } = action.data;
  lazy.NewTabUtils.activityStreamLinks.deleteHistoryEntry(
    original_url || url
  );
  break;
}

Conclusion

I waited for my patch to be approved and landed.

TLDR:

The issue was that Amazon was in the user's actual history, but the displayed url got silently swapped to the search-shortcut version, so the delete call looked for a url that no longer existed in Places.

Links:

🕷️ BUG: https://bugzilla.mozilla.org/show_bug.cgi?id=1628669

💗 PATCH: https://phabricator.services.mozilla.com/D292910

👤 MY PROFILE ON BUGZILLA: https://bugzilla.mozilla.org/user_profile?user_id=786766

DEV Community: mozilla

Most big Firefox add-ons still don't say what they collect

Updated since July, and still nothing

Nothing makes them

Being honest costs you

Firefox: New security update protects against fake websites

Protection against counterfeit certificates

Additional improvements

Mozilla accuses Microsoft of pressuring users to install Edge

The situation in Europe and Mozilla's demands

The bigger picture in technology

How to stop worrying about protecting your data

The fatigue of constant decisions

Six simple ways to reduce fatigue

Thunderbird 158 released with major fixes and faster search

What changes in daily use

Fixes for encryption and synchronization

Specific improvements for Linux and other services

How will you receive the update?

Mozilla introduces Firefox Enterprise for centralized management in businesses

How management works

Security and control capabilities

Support and next steps

Firefox 158 released with native support for JPEG XL images

Better PDF management and smoother scrolling

New personalization options and conveniences

Firefox 158 now available with built-in support for JPEG XL images

Mozilla Measured the Open-Weight Gap: 5 Points, 8 of 10, 4% of Revenue

The measurements

Why a 5-point gap and a 4-month gap are the same fact

Usage on OpenRouter

What the numbers do not cover

The economics

Where open stalls

Capability without pretraining

Firefox Smart Window’s Mistral option is hosted AI, not local inference

Key facts

In-Depth Analysis: Mozilla's Built-In Ad Blocker f…

Introduction

Understanding Mozilla's Built-In Ad Blocker

Key Mechanisms of the Ad Blocker

The Architecture Behind the Ad Blocking Feature

How It Works

Comparison with Other Technologies

Why This Matters: The Impact on Web Development

Importance of Ad Blocking in Modern Browsing

Real-World Implications

When and Where to Implement Ad Blocking Solutions

Use Cases for Businesses

Industry Applications

What Does This Mean for Your Business?

Business Implications in Colombia and Spain

Local Market Considerations

Next Steps for Your Team

Conclusion and Actionable Insights

Recommended Steps

Preguntas frecuentes

Preguntas frecuentes

¿Cómo afecta el bloqueador de anuncios a la experiencia del usuario?

¿Qué industrias pueden beneficiarse más de esta tecnología?

Need Custom Software Solutions?

I solved a 5 year old bug

Introduction

Bug Report

Background

The Problem

Why This Happens

Understanding the Bug (Part A)

Understanding the Bug (Part B)

The Fix

Conclusion

Thank you, please follow me