Generally, this seems an obvious and correct decision for Tor.
Barring integration with a locally run LLM, AI doesn't make sense for the Tor security posture - you don't want to be routing content to unintended/insecure third parties, period.
I do not want nor need AI in every single aspect of my life. I mean, I've seen AI hygiene products out there. How does that even work? Don't answer that ... I know it's a marketing scheme, akin to the "HD" craze of five to 10 years ago.
I file a ticket with Firefox whenever an unwanted dialog pops up covering content. If you tag these as being accessibility related they get bounced back and forth between a few people before getting closed and thus pour just a little bit of sand in the gears.
As a long-time firefox user (since the very earliest days of phoenix), I have to say: focus on open standards and delivering a faster and more secure browser. Make runtimes like electron out of your engine. DO shit that matters. Forget pocket, AI, and all that other junk. That is not your mission!
Just an FYI for anyone who is interested, I’ve also been doing the same for Waterfox.
Mozilla have taken into consideration doing things locally, such as tab organisation and the likes (one would assume pre-GPT era and with regard to features not utilising LLMs this would’ve been branded as ML functionality) but I’m not fully convinced this still won’t open up potential security issues in the future[for users of AI browsers].
For Tor users this seems even more of an issue as one would expect nation-state actors targeting undesirables would look for any potential weak spot to exploit.
Separately I suppose this brings into light how utterly crazy it seems having AI features in the browser chrome versus limited to the website content process/sandbox. It seems like a privacy and security nightmare and now everyone and their gran are releasing “AI browsers”, even the Firefox-based ones inspired by browsers such as Arc and Dia which seem like absolute privacy nightmares.
Seems like slick branding and marketing gets you a pass today when in the past such egregiousness would receive a load of flack cough Avast “secure” browser cough…
Either way good job to the Tor team, I sympathise with how much extra load this adds to each rebase.
I hope Orion (from Kagi) gains more traction and follows through w/ open-sourcing everything. Privacy-first, 0-telemetry, performant, capable... just not OSS (yet).
Since we're all here to complain about Firefox, I want to add that at this point I'm a firefox user out of principle, but I swear I get so many weird performance issues with firefox on ubuntu that it feels like self-flagellation in service of the gods of the free and open Internet.
Unfortunately they're the kinds of problems that are really hard to submit tickets for: gradual degradation of performance over the course of a week until I kill the process and start it again, the occasional crash that I can't seem to associate with anything in particular, a bizarre bug where every once in a while firefox slows down and typing letters into any input field has a ~30 second delay...
I've never cared about AI or Pocket or anything like that, I just want firefox to be reliably snappy. And I really, really don't want a browser ecosystem dominated by two for-profit companies.
There are far too many "luminaries" in the tech industry who've had the last 20 years of "must create value!" go to their heads, even in the FLOSS space.
When profit motive does not exist (and it shouldn't in FLOSS) then you need to stick to things like the UNIX philosophy and KISS (keep it simple, stupid) in order to create good software. Trends mean nothing when you're in this mindset.
It's Firefox. It's a browser. It does browser things; namely, it sends HTTP requests, possibly executes JavaScript, and renders the resulting computed data on a screen as HTML. It does not need to have AI integrated. At best, AI should be a downloadable extension.
If the group's leadership cannot comprehend this, then they need to be removed immediately and blacklisted from leadership at future organizations in the future.
"Mozilla has reversed course on when the protocol portion (e.g. http or https) of the URL in the URL bar is hidden since Firefox 128. We used to have logic in one of our patches around Onion Services (which are always end-to-end encrypted regardless of the application-level protocol used) to follow whatever Firefox does for https. However, with the latest changes in Firefox, this patch became a bit gnarly to apply correctly so we took a step back and thought to ourselves, why are we even conditionally hiding this from the user?"
It makes me a little sad we only ever see FF hit the front page of HN for stuff people are angry about. The FF team building useful features like tab groups that are improving UX. But I guess if it bleeds it leads.
I dont know why anyones being defensive about firefox as if they have drawn ire for no reason at all, when in my xp they have done alot of sus stuff, and I hardly know anything about well anything.
Mozilla get >80% of its revenue from Google, by making Google Search as default search engine on Firefox.
While Mozilla pretends to be a non-profit, its CEO makes millions of dollars annually.
Mitchell Baker: Stepped down as CEO of Mozilla in February 2024. Her salary for 2023 was reported to be $6.9 million.
Laura Chambers: Became interim CEO of Mozilla in February 2024. Mozilla has not disclosed her salary for 2024 yet.
As of October 2025, the average annual salary for employees at Mozilla in the United States is ~$115k.
Not bad for a "non-profit", eh?
Yup, Mozilla and Firefox are surviving (nay, thriving) due to Google.
But Google's hand on the Mozilla tiller, is merely the top of the proverbial iceberg.
Google has a monopoly on the browser market, encouraged by Apple Safari slipping down to <14% market share amongst the leading browsers.
Google's Chrome (>71% market share) and the other Chromium forks (>9% market share: Edge ~4.5%, Samsung Internet Browser ~2%, Brave/Vivaldi/etc. ~1%) dominate the browser market. Opera (~1.75% market share) is not a Chromium fork, but it is based on Chromium Project.
Tor browser's philosophy is that everyone should be fingerprinted and it's fine since they do everything they can think of to try to make that fingerprint identical to everyone else using Tor browser.
This is kind of crazy since there are new fingerprinting techniques all the time and if they miss even one data point the whole game is lost. The smarter movie would be to make sure that fingerprints are unique/randomized so that even the same person looks like different people but for some reason they're confident they can account for every possible identifying metric 100% of the time.
29 comments
[ 2.7 ms ] story [ 48.9 ms ] threadBarring integration with a locally run LLM, AI doesn't make sense for the Tor security posture - you don't want to be routing content to unintended/insecure third parties, period.
I do not want nor need AI in every single aspect of my life. I mean, I've seen AI hygiene products out there. How does that even work? Don't answer that ... I know it's a marketing scheme, akin to the "HD" craze of five to 10 years ago.
https://support.mozilla.org/en-US/kb/ai-chatbot
Seems to be unconnected to any model and off by default.
Mozilla have taken into consideration doing things locally, such as tab organisation and the likes (one would assume pre-GPT era and with regard to features not utilising LLMs this would’ve been branded as ML functionality) but I’m not fully convinced this still won’t open up potential security issues in the future[for users of AI browsers].
For Tor users this seems even more of an issue as one would expect nation-state actors targeting undesirables would look for any potential weak spot to exploit.
Separately I suppose this brings into light how utterly crazy it seems having AI features in the browser chrome versus limited to the website content process/sandbox. It seems like a privacy and security nightmare and now everyone and their gran are releasing “AI browsers”, even the Firefox-based ones inspired by browsers such as Arc and Dia which seem like absolute privacy nightmares.
Seems like slick branding and marketing gets you a pass today when in the past such egregiousness would receive a load of flack cough Avast “secure” browser cough…
Either way good job to the Tor team, I sympathise with how much extra load this adds to each rebase.
Tor is my daily browser btw.
Seems about time someones does the "I use Tor btw" trend.
Unfortunately they're the kinds of problems that are really hard to submit tickets for: gradual degradation of performance over the course of a week until I kill the process and start it again, the occasional crash that I can't seem to associate with anything in particular, a bizarre bug where every once in a while firefox slows down and typing letters into any input field has a ~30 second delay...
I've never cared about AI or Pocket or anything like that, I just want firefox to be reliably snappy. And I really, really don't want a browser ecosystem dominated by two for-profit companies.
Make the fucking old and ugly browser interface customizable. And expose this to webpages, so banks could force you to use the default view.
There are far too many "luminaries" in the tech industry who've had the last 20 years of "must create value!" go to their heads, even in the FLOSS space.
When profit motive does not exist (and it shouldn't in FLOSS) then you need to stick to things like the UNIX philosophy and KISS (keep it simple, stupid) in order to create good software. Trends mean nothing when you're in this mindset.
It's Firefox. It's a browser. It does browser things; namely, it sends HTTP requests, possibly executes JavaScript, and renders the resulting computed data on a screen as HTML. It does not need to have AI integrated. At best, AI should be a downloadable extension.
If the group's leadership cannot comprehend this, then they need to be removed immediately and blacklisted from leadership at future organizations in the future.
Mozilla get >80% of its revenue from Google, by making Google Search as default search engine on Firefox.
While Mozilla pretends to be a non-profit, its CEO makes millions of dollars annually.
Mitchell Baker: Stepped down as CEO of Mozilla in February 2024. Her salary for 2023 was reported to be $6.9 million. Laura Chambers: Became interim CEO of Mozilla in February 2024. Mozilla has not disclosed her salary for 2024 yet.
As of October 2025, the average annual salary for employees at Mozilla in the United States is ~$115k.
Not bad for a "non-profit", eh?
Yup, Mozilla and Firefox are surviving (nay, thriving) due to Google.
But Google's hand on the Mozilla tiller, is merely the top of the proverbial iceberg. Google has a monopoly on the browser market, encouraged by Apple Safari slipping down to <14% market share amongst the leading browsers.
Google's Chrome (>71% market share) and the other Chromium forks (>9% market share: Edge ~4.5%, Samsung Internet Browser ~2%, Brave/Vivaldi/etc. ~1%) dominate the browser market. Opera (~1.75% market share) is not a Chromium fork, but it is based on Chromium Project.
https://gs.statcounter.com/browser-market-share/
This is kind of crazy since there are new fingerprinting techniques all the time and if they miss even one data point the whole game is lost. The smarter movie would be to make sure that fingerprints are unique/randomized so that even the same person looks like different people but for some reason they're confident they can account for every possible identifying metric 100% of the time.