Firefox UI debacle

How To avoid the ugly, less functional, new Nova UI on Firefox.

In October 2026, without much warning, Mozilla rolled out a substantial user interface (UI) change, called Nova, to Firefox. Unfortunately, Nova is ugly and less functional than the prior refined UI called Proton.

 

Fortunately, there is a simple UI solution (until at least September 2027), which is to switch from regular Firefox to Firefox ESR (Extended Support Release), which retains the classic Proton UI style and is more stable.

 

To avoid issues, install (not update) Firefox ESR in a different directory (e.g., Mozilla Firefox ESR) with a new profile, then use Firefox Sync to update bookmarks and other data, and install any extensions that Sync missed. That way both Firefox versions can be used, and either version can be easily uninstalled.

 

Download ESR release 153 (not an earlier version) here:

https://www.firefox.com/download/all/desktop-esr/

You should then switch Settings→About Firefox→Firefox updates from Automatic (the default) to Check & choose, so that you can get security updates (until at least September 2027), but avoid a major version update as long as possible (or until the new Mozilla CEO comes to his senses).

ESR

Because enterprise customers demand stability, Mozilla has a separate, more stable release channel called Extended Support Release (ESR) that is updated infrequently except for security updates.

Linux

• ESR install instructions by Mozilla: Install Firefox on Linux 
• Installing Firefox ESR on Ubuntu (Without Snap)

Backstory

Mozilla got a new permanent CEO in 2025, and he set about embracing AI and updating Firefox in an attempt to reverse its market share slide. Unfortunately, Mozilla had laid off and otherwise lost so much of its key development talent that he turned to 'easy' UI changes instead of hard core functionality improvements (like support for Progressive Web Apps) and bug fixes, so he could appear to be doing something. By aping more successful products he could claim to be making 'improvements' but while losing distinctiveness, which never works.

Welcome to the Dead Internet

What used to be considered a fringe idea known as the "Dead Internet Theory" has essentially become reality.

Recent data confirms that synthetic content and automated activity have officially overtaken human output across much of the Web.

Latest 2026 research:

• Social Media Content: A recent study by the Media and Journalism Research Center analyzed 40,000 public posts across LinkedIn and Facebook and found a staggering 90% of them were created using AI.
• Overall Web Traffic: In June 2026, Cloudflare reported that for the first time in history, automated traffic overtook human traffic. Bots (including AI agents, scrapers, and crawlers) now account for 57.5% of all web requests.
• The Growth Rate: Agentic AI traffic—AI systems autonomously browsing, researching, or posting on behalf of users—grew by nearly 7,800% year-over-year in 2026. 

What This Means

The sheer volume of AI-generated content has fundamentally changed how social platforms operate. Because AI models can instantly synthesize and repackage existing information, the baseline for "average" content has skyrocketed. However, this flood of synthetic text has also led to a sea of homogeneous, predictable posts.

How to Tell  

It can be extremely hard to tell the difference. 

• Follow a feed of carefully vetted sources, and 80% of the content will likely be human created. 
• Follow "Discover" or "For You", and 80% of the content will likely be bot generated.
• Could You Spot an AI-Powered Scam? See If You Can Tell What’s Real | AP News 

E*TRADE Security Failure

Opening an E*TRADE account was a Security Disaster

The E*TRADE (part of Morgan Stanley) new account intake process was straightforward if a bit tedious, demanding not only personal information, including phone numbers, but also the uploading of a picture holding a government ID through DocuSign.

An intake process like this should normally complete within 24-48 hours, but it was 5 days before receiving a confirmation email that the account was open and accessible with the Account ID and Password. In the meantime, the webpage and chat always showed red alerts that they were having "technical issues" and to "try again later" (which was anything but reassuring).

But logging in did not bring satisfaction. After being asked for more information that should have been captured at account creation, an attempt to enable 2FA (two-factor authentication) for improved security resulted in a demand for a phone number, despite the fact it had been provided during account creation. Adding insult to injury, the system then rejected that phone number, locking the account, preventing access to any money.

Authentication and Security 

E*TRADE (Morgan Stanley) was apparently adding mobile carrier verification despite having previously accepted both phone numbers and government ID. In addition to being a classic chicken-and-egg problem, mobile carrier verification is not a good way to verify security, because it is so easily hacked or spoofed. In effect they were downgrading password security by asking for a phone number after password login. Bad actors that have the password are already in.

What should have happened during new account intake, in addition to capturing all necessary information, is setting up secure 2FA using a TOTP authenticator app (by Google, Microsoft or others), completely solving authentication. Instead, this kind of 'security' nonsense is comparable to the security lapses in so-called Wired Equivalent Privacy, which turned out to be hackable in minutes.

Three Strikes

1. Technical Problems. Persisting over several days. 
2. Account Lockout. Arbitrary denial of access to any money. 
3. Security Lapses. Redundant use of insecure mobile carrier verification.

You should never entrust money to an online system with such serious issues. 

Why Use Apple/Google Pay

Security and Privacy in addition to Convenience

Most people adopt Apple Pay or Google Pay mobile payment because tapping a phone or smartwatch at checkout is faster and easier than fumbling through a wallet for a payment (credit or debit) card. While that convenience is great, it’s actually not the most important benefit. The best reason to use mobile payments: you don't give your payment card number to the merchant, which keeps you safe from:

1. Card skimmers: Fraudulent readers secretly installed on gas pumps, ATMs, or store terminals to steal and exploit your card info. 
2. Merchant database breaches: Hacks on store servers that expose millions of stored card numbers, expiration dates, and security codes.
3. Unauthorized charges: With saved card info, unscrupulous merchants can charge you for unauthorized goods or services, particularly subscriptions you've forgotten. 
4. Insider theft: Dishonest staff photographing or writing down your card details when taking your card behind a counter. 
5. Cross-merchant tracking: Data brokers using your card number to track your shopping habits across different businesses. 

Mobile Apps: Apple Wallet / Google Wallet. 

How it Works

• Your card number stays local: Your actual 16-digit card number is stored in an encrypted, isolated hardware chip on your device. It is never transmitted to the merchant or stored on cloud servers.
• Merchants get a temporary number: For every transaction, the wallet generates a unique, one-time security code along with a merchant-specific token (Device Account Number). If a merchant’s database gets hacked, the stolen token is completely useless to thieves.
• Real-time charge tracking: You get an immediate push notification the second a transaction occurs, making it simple to spot unauthorized activity instantly rather than waiting for a monthly statement.
• No runaway subscriptions: Because payments rely on controlled tokenized connections, cutting off a merchant or stopping unwanted recurring charges is far easier, and doesn't require canceling your physical credit card and updating every other account.
• Full dispute mechanisms intact: You don't lose consumer protections. Your bank's zero-liability policy, dispute processes, and charge-back rights remain fully active on every transaction.

Smart‑TV 'Privacy'

Smart TV Data Harvesting

“You have zero privacy anyway." —Scott McNealy

There is no privacy on a "smart" TV. The modern television business model isn't about just selling you hardware, it's also based on telemetry, harvesting and selling your personal viewing habits and data. Whenever and whatever you watch, that info is being 'phoned home' to data brokers.

The Solution 

The only real mitigation is to never give the TV access to the Internet. Skip the Wi-Fi setup, leave the Ethernet port empty; instead, use an external streaming box that you control. 

If you want to stream content from a smartphone, tablet or computer, use Wi-Fi Direct instead of a local network:

• Apple: Use Peer-to-Peer AirPlay. Ensure both Wi-Fi and Bluetooth are enabled on your iOS device or Mac, and you can mirror your screen directly to compatible TVs without a router. 
• Android: Use the built-in Cast or Screen Mirroring feature (sometimes labeled Smart View). This utilizes Wi-Fi Direct (Miracast) for direct wireless connection to the TV.
• Windows: Press Win + K to open the Cast menu. This uses Miracast to project your screen direct to the TV without needing a local Wi-Fi network.

Surfshark VPN No Longer Recommended

No to Surfshark VPN

The Problem 

Surfshark was formerly a recommended VPN service, but no longer:

1. Payment Card Abuse. A payment card is a required part of an account, making you vulnerable to unauthorized charges. 
2. Aggressive Upselling. Not content to just provide good service, Surfshark aggressively pushes services you do not need or want, going so far as to create subscriptions with automatic renewals that you never ordered.  
3. Blocked IPs. Abuse by customers of a limited IP pool means that Surfshark connections are increasingly blocked by network providers.  

The Solution

It's surprisingly hard to find a good, low-cost VPN, with ample IP pools, high performance, and solid privacy policies. It's not perfect, but my current top pick is Private Internet Access (PIA).

• No logs
• Open Source 
• Reliable access 
• 10 Gbps servers optimized for speed
• Unlimited devices on one plan from $2.03/mo 
• Every setting can be customized 

See Also

• Navas' Tips: Secure Wi-Fi With VPN
• Navas' Tips: Best Consumer VPN 2025-2026 

Starbucks Tipping Goes Rogue

New Starbucks Tipping

The Problem

Tipping is supposed to be a reward for good service, but Starbucks does not actually provide table service, just counter service, and the brewing of coffee is now fully automated (and mediocre). So the 'barista' (using the term loosely) now just takes your order and pushes a brew button. Is that service worthy of a tip?

If you pay with the app on a smartphone, you already have a tipping option (and notification) should you choose to tip, but now Starbucks hits you again on the new Verifone tipping terminal.

Worse, if you walk away without touching the terminal, it stays wide open to abuse, like a barista reaching over to apply a tip without your consent (which has actually happened, perhaps inadvertently, but still fraudulent).

And the most outrageous thing of all is that the fixed tip amounts—not percentages like at more responsible restaurants—are egregiously high for a lower-cost item like a brewed coffee (as in the picture):

• 30% at $1 tip
• 60% at $2 tip
• 149% at $5 tip

The Solution

Until Starbucks changes course, putting customers back ahead of greed, the solution is to mobile order ahead, thereby avoiding the tipping terminal entirely. You can even select personal cup for the discount and extra stars!

Dump the Un-Carrier!

The Bad News: All 3 major carriers now suck!

Under President John Legere, T-Mobile USA was the customer-focused "un-carrier" that offered great pricing, service and performance. That all changed when he left, and now T-Mobile is just another big evil carrier. 

It was bad enough when T-Mobile first broke Legere's promise to 'never raise your price' but now it has gone full evil by forcing subscribers from great legacy plans to new more expensive plans, along with unbundling taxes and fees for new customers. Worse, it slip-streamed it into the Terms of Service, leaving unhappy customers with little recourse. It's now entirely money-focused.

The Good News 

You can switch to a much better carrier and save a great deal of money without losing great network performance, with much better customer service in the bargain. That escape path leads to US Mobile, an MVNO (Mobile Virtual Network Operator) with access to all three major carrier networks. (It's even possible to switch networks as desired!)

The best part is that you may be able to at least take advantage of the 'Un-Carrier Guarantee' to get your last month of service free when leaving T-Mobile after a price increase. You may have to fight for it, because not all T-Mobile service reps even know it exists, and resist pressure to get you to stay, but you can get it if you persist and act promptly.

One of the best deals that's frequently offered by US Mobile is a full year of Unlimited Starter for only $199 (just $17 per month) all in (no added taxes and fees): Unlimited Talk & Text, 70 GB of High-Speed Data and 10 GB of Hotspot Data on the T-Mobile network, and more. Plus it often has great deals on devices!

Do it, now, and if you use my referral code, you will get a $25 credit! (I get one too.) 

Subscription Creep

Stop Subscription Creep

How to stop subscription charges for good

Vendors love subscriptions because people forget to cancel them (so charges keep going). They can even make it hard to cancel. Part of the problem is that it can be a big hassle to regularly audit all your payment card statements to find the ones you no longer need or want. Another part of the problem is that it can be hard to jump through the necessary hoops to cancel. Fortunately, there is a simple, effective solution.

A related problem is that vendors can record and keep your card numbers for future transactions that you may not actually authorize. 

The "Nuclear" Option 

The simplest, most reliable solution is to force‑expire every payment card once a year. Ask your card issuers to replace your cards with new numbers but without Card Updater Service.*

When that happens, every subscription dies automatically and all saved card numbers are invalidated. You then just need to give your new card numbers to those subscriptions and vendors you want to keep.

The PayPal Option 

A big advantage of PayPal over a payment card is that vendors cannot keep a card on file and make charges without authorization.

• Individual payments must always be expressly authorized by you.
• Recurring (or subscription) payments must be expressly authorized in advance by you, and can be easily managed (e.g., canceled) in your PayPal account.

No need for spreadsheets, audits, “subscription manager” apps.

* Card Updater Service means that your issuers will cheerfully switch your zombie subscriptions to your new card numbers, defeating the Nuclear Option.

ThinkPad Lock on Leave can work

Lock on Leave for the ThinkPad P14s Gen 4 is well hidden!

• Windows Presence Sensing is not supported.
• Instead, Lenovo provides its own Lock on Leave feature.
• Locking may not be reliable in some environments, like noisy cafes!
• Lenovo documentation is not correct! 
• Expanded How To in Lenovo Community.
• Likely applies to T14 Gen 4, P14s Gen 4, T16 Gen 2, P16s Gen 2.
• It may also apply to P14s Gen 5 and P16s Gen 3.

How to enable Lenovo Lock on Leave

1. In BIOS Settings → Security → Intelligent Security → enable User Presence Sensing.
2. In Commercial Vantage (from Microsoft Store) → Device Settings → Smart Assist → enable Zero touch lock.

Windows Settings 

1. Use Default settings in Windows Balanced Power Plan.
2. Set Screen Saver to (None) because it is redundant and possibly counterproductive.

What actually happens

• ~20 seconds of no presence → screen dims
• ~10 seconds later → screen blanks & locks
• No wake‑on‑return, but Windows Hello can activate and unlock on a keypress
• Invisible: no tray icon, no indicator, no tuning

How it works

• Uses speakers to emit ultrasonic pulses
• Uses microphones to read reflections
• Elliptic’s AI model decides “present” vs “absent”
• No dedicated hardware sensor, no FRU

Side effect
Some users can hear the ultrasonic chirps due to:

• speaker distortion
• harmonics
• individual high‑frequency sensitivity

If you hear it, you’re not imagining it.