I don’t know if this applies directly, but in my early days of hosting a server for fun, I installed a telnet server because my phone didn’t have SSH at the time. I forgot to close it when i was done and someone got in and installed a password sniffer. This was a Slackware box, IIRC. My only indication that there was a problem was that the “.” & “…” directories didn’t appear from an “ls -Alf”. I pulled the network cable and booted to a boot image and discovered that many key system utilities were replaced with imposters that would mask that there was an intruder. The '“ps”, “ls” and other utils were symlinked to the “…” dir in /usr/local/lib.
I didn’t trust anything on that server and nuked it. Now, anything that’s internet facing is built from ansible and the config is stored in a repo and the repo is backed up on a drive that’s physically disconnected except when backing up. I’ve messed up the initrd from time to time and it’s usuall easier for me to reimage than try to fix it.
I’m not as enraged by this as most, but I think the true test will be to see if this feature is disabled by default in future releases. If they actually do listen to their users, that’s better than any of the other big players.
I read a bit about the new “feature” and it seems to me that they’re trying out a way to allow ad companies to know if their advertisement was effective in a way that also preserves the privacy of the user. I can respect that. I did shut it off, but am also less concerned because I have multiple advertisement removal tools, so this feature is irrelevant.
The fact that it’s enabled by default isn’t comforting, but who would actually turn this on if it were buried in about:config? In order to prove its effectiveness to promote a privacy respecting but advertisement friendly mechanism, this is what they felt that they had to do.
Of course, I could easily be all wrong about this and time will tell.