Push Notifications Require a 24/7 Connection to Mozilla Servers.

First of all, I'd like to thank this team for their efforts of making a more private web browser than the one its base on.

My concern today, is regarding Mozilla's implementation of push notifications. LibreWolf is unfortunately inheriting what I'm concerned about.

You see, each time you launch LibreWolf, without accessing any websites, it immediately establishes a connection (that is maintained 24/7; as long as the browser is open) to Mozilla severs that are hosted at Amazon AWS.

You can verify this by monitoring your connections after a fresh reboot. Upon launching LibreWolf, you'll notice it establishes a connection to an IP address like this one:

2022-08-21_20-35

From what I've gathered, this connection is created to facilitate Mozilla's implementation of push notifications. Instead of an implementation that creates a direct push, from the website you've allowed to push, each push notification has Mozilla as an intermediary.

While this implementation most likely has divine intentions, I consider it a slippery slope. I don't want my web browser to maintain a 24/7 connection to any 3rd party. While right now, this connection may be exclusively used to facilitate push notifications, the very same connection could evolve as a relay to report a user's entire web activity.

Surely, the spec doesn't require the browser-maker to run a 3rd party service in order to facilitate push notifications. The websites I've permitted, push notification for, should be facilitating those pushes directly, and Mozilla shouldn't be an intermediary that has an excuse to maintain a 24/7 connection to my computer!

For now, I've disabled this via about:config > dom.push.enabled = false.

Yet, I wanted to voice my concerns to this development team, and see what you're thoughts are.

Edited by Lonnie Best