Firefox

Firefox is getting Tab Previews soon

Posted on by Martin Brinkmann

Mozilla has launched support for Tab Previews in Firefox Nightly officially. Firefox displays a thumbnail image of the open webpage on hover once the feature is enabled.

Current versions of Firefox display just the title of the website on hover. Firefox shows just the first few characters of a title on the tab itself by default.

While the title is sufficient for some users, others may prefer to see a preview of the actual web content. This may help identify the right webpage and thus tab when switching tabs in Firefox.

Once enabled, Firefox shows a preview of the webpage on hover.

Firefox users who run the Nightly version may enable Tab Previews in the following way:

  1. Load about:config in the Firefox address bar.
  2. Click on Accept the Risk and Continue.
  3. Search for browser.tabs.cardPreview
  4. Double-click on browser.tabs.cardPreview.enabled to set the value to True, , if it is not true already.
  5. Double-click on browser.tabs.cardPreview.showThumbnails to set the value to True, if it is not true already.
  6. Restart Firefox.

You should get previews now when you hover over a loaded tab in the browser.

Disable tab previews: if you do not like tab previews, you can disable them by setting browser.tabs.cardPreview.enabled to False.

A third preference determines how fast or slow previews are shown. This is browser.tabs.cardPreview.delayMs, which you may also change on about:config. The value is in milliseconds. Reduce the number and previews are shown quicker, or increase it, to get more hover time before tab previews are shown.

Bonus tip: set browser.taskbar.previews.enable to True to show up to 20 thumbnail images of open webpages in Firefox when hovering over the Firefox icon on the taskbar of the operating system. You can change that number by modifying browser.taskbar.previews.max on about:config.

Closing Words

Mozilla will enable Tab Previews in Firefox by default in the future. Good news is that users can disable the feature, if they have no use for it. Will take months before the feature lands in Firefox Stable.

Will you keep tab previews enabled or are you using them already in another browser?

TotalRecall: search Windows 11 Recall data and return results

Posted on by Martin Brinkmann

TotalRecall is a new open source tool for Windows that can be used to run searches across the entire Recall database.

Recall is a new feature of Windows 11 that takes snapshots of the screen every five seconds. It stores them locally and makes them available for processing by the user.

Recall is enabled by default on supported systems. Users may disable Recall, but only after the initial setup. While that may change before public release, and Microsoft would do good to make the change, it is on by default right now.

The feature is officially available only for a batch of ARM64 devices at the time of writing, but it will expand to Intel and AMD hardware soon as well. Plus, there are tools available already to make it work on older ARM devices that do not have a NPU chip.

The data is protected, but unlocked once the user logs in. It is then accessible by the user, but also by System or Admin accounts. In other words, any process that runs as System or Admin may be used to access the data.

It does not take an Einstein to connect the dots here to spot the elephant in the room: malware and spyware will target Recall data. It reveals any activity of the user, with the exception of activity in certain private browsing windows.

Forget tracking, you get a clear picture of a user’s likes, dislikes, webpages, apps, games, documents, financial transactions, online banking, private and public messages on forums and chats, and much more, when you gain access to that data.

TotalRecall

TotalRecall is a third-party tool that makes the data searchable via the command line. Run a search for password, and the tool runs a query to return any user activity associated with the term password.

It saves the search results to a text document on the system. This file provides details on the “captured windows, images, and search results”.

You can limit the search to a specific data range or run it across the entire data.

Here is what the tool does:

TotalRecall copies the databases and screenshots and then parses the database for potentially interesting artifacts. You can define dates to limit the extraction as well as search for strings (that were extracted via Recall OCR) of interest. There is no rocket science behind all this. It’s very basic SQLite parsing.

Closing Words

Microsoft, probably, did not expect to receive that much backlash for Recall. It is anyone’s guess whether Microsoft is going to make adjustments to Recall.

Windows 11 users who buy a laptop that is Recall capable, may want to strongly consider turning it off. While it may be a useful tool in very specific work scenarios, the chance of Recall turning into a nightmare for many Windows users is a real one.

Cobalt.tools Download Videos

This online video downloader is fast, customizable, and ad-free

Posted on by Martin Brinkmann

While I still swear on Internet Download Manager for all my downloading needs, many users may need such tools only occasionally or do not want to pay for a service. If you need to download a video every now and then, then you may prefer a fast solution that does not need to be installed.

Cobalt.tools is such a tool. Yes, there are numerous video downloaders out there, but hear me out.

Cobalt is an ad-free, tracking-free solution that has a minimalistic design. It worked with every video service I threw at it. Probably won’t work with DRM-videos, but that is a limitation for all video downloaders.

To use it, you simply paste the video URL into the form on the website. Hit the >> button and you get the download dialog of your browser. It does not get simpler than that.

The default configuration is set to auto. This means that Cobalt determines what to download and the quality of the download.

Cobalt Settings

A click on settings shows a number of preferences. Here you can make changes to video, audio, and other settings.

  • Video — Change the preferred quality between 8k+ and 144p
  • YouTube Codec — Switch from h264 to av1 or vp9.
  • Twitter — Convert Gifs to .gif.
  • Audio — change format from mp3 to ogg, wav, opus, or “best”.
  • Mute Audio — remove audio from videos.
  • Use browser language — so that YouTube dubbed audio tracks provide the correct audio track.
  • Appearance — light and dark mode supported.
  • File name style — classic, basic, pretty, and nerdy (pick pretty).

Closing Words

Cobalt.tools is an excellent video downloader. It is easy to use and privacy friendly. You can customize it, if you want, but this is optional.

While it is not best-suited for mass download sessions, it may work for that as well, albeit a little bit less comfortably. Its strength is its simplicity. Paste, click go, and save. It does not get simpler than that.

Which video downloader do you use, if any? Feel free to leave a comment below.

Facebook

Facebook will use your data for AI training, unless you opt-out

Posted on by Martin Brinkmann

Meta is notifying its users currently on Facebook about a privacy-impacting change that will to into effect on June 26, 2024.

The company says that it is expanding “AI at Meta experiences” to the user’s region. AI refers to the “collection of generative AI features and experiences” at Meta. It includes Meta AI and AI Creative Tools according to the notification.

All Facebook users are opted-in automatically. Those who do not want their data to be used for AI training need to opt-out. This opt-out is not straightforward and it appears to be a deliberate decision by Meta.

Meta Facebook AI use of data for AI training

A click on the right to object link in the notification opens the Object to Your Information Being Used for AI at Meta page.

The page offers information on the data that Meta plans to use for AI training and the data that it won’t use. In a nutshell, public data, for instance posts or photos, will be used. Private data, including private messages, won’t be used.

For the opt-out, it is necessary to provide the following information:

  • Country of residence.
  • Email address.
  • Writing an essay on “how this processing impacts you”.

There is also one optional text field that users can fill out to provide additional information.

Meta processes the information and the notification sounds as it if can accept or decline the request. Meta writes:

If your objection is honored, it will be applied going forward.

This is not the end of it though. Meta sends a confirmation code to the email address. This code needs to be entered into a form on the Facebook website to confirm the email address.

Meta then says that it will review the submission as soon as possible. It took less than a minute to receive the answer:

Hi Martin,

We’ve reviewed your request and will honor your objection. This means your request will be applied going forward.

If you want to learn more about generative AI, and our privacy work in this new space, please review the information we have in Privacy Center.

facebook.com/privacy/genai

This inbox cannot accept incoming messages. If you send us a reply, it won’t be received.

Thanks,
Privacy Operations

In case you are wondering what I wrote in the required text field. It was “I object to the use of my data for the training of AI at Meta”

Whether Meta is analyzing user requests with AI is unclear, but it seems very unlikely that a human processed the request in less than a minute after sending it.

If someone could try and write nonsense in the field, we’d know for sure.

What about you? Do you mind if your public data is used for AI training?

Windows 11 Recall data is not secured properly

Posted on by Martin Brinkmann

Is the upcoming Recall AI feature of the Windows 11 operating system a privacy nightmare? While the verdict is still out about that, it is clearly problematic on several levels in its current state.

Recall takes screenshots of the computer screen every 5 seconds. The default configuration takes screenshots of pretty much everything. The only exceptions are private browsing windows of popular browsers and DRM-protected content.

Every other activity, including views of financial documents, porn, games, visited websites, messages, and more may be captured.

It saves the data to a locally stored SQLite database. There it is kept until it is either deleted to make room for newer data or deleted by the user.

Users have several options:

  • Disable Recall entirely, which will likely erase the entire database.
  • Reduce the assigned storage size, which will delete older entries.
  • Use the delete snapshots option to delete some or all snapshots taken.

Multiple parties want access to Recall

Since Recall saves a user’s entire work history on a device for three months by default, it will be seen as a treasure trove by multiple parties.

  • Malware actors may find ways to grab the entire database, which is not encrypted when the system is running.
  • Law enforcement, customs, spies, state sponsored hackers may also want access to it.

Recall offers interesting data. Screenshots of one-time messages, or messages that get deleted by the user of the PC. These remain in the database until they are flushed out because of age.

Recall is not all that useful for most Windows users

The idea of searching through the computing activity of the past three months may sound appealing to some users.

In work or research environments, it may be seen as a great feature, provided that Microsoft gets privacy, security, regulatory requirements, and all of that in order before release.

For most home users, Recall does not have a great value proposition.

What problem is Recall solving? How often do home users need to find something very specific on their devices that they have trouble finding using the built-in search or manual searching?

In all of Microsoft’s talks and announcements, the company has not really answered that question.

If you weight this now against the prospect of maintaining a database on your computer that reveals what you have done on it in the past three months, then it is likely that most users may pass on this.

Depending on how it launches, enabled by default, with or without notification to the user, it is probably not going to see the wide use that Microsoft hopes it will have.

Closing Words

Recall is not here yet and things may change before the final release later this year. Most home users who happen to purchase Copilot+ PCs may want to consider disabling Recall to block the feature from recording everything they do on their devices.

I suggest you check out the following thread on Recall for additional information on it and the issues that it introduces.

What about you? Would you make use of Recall, if it would be available on your devices?

Google

Latest Chrome 125 security update fixes 11 unique issues

Posted on by Martin Brinkmann

Google has released a new security update for its Chrome web browser for all supported platforms. The update patches 11 unique security issues in the browser. It comes days after an out-of-bounds security update for Chrome to address a 0-day security vulnerability.

While the issues do not appear to be exploited at the time of writing, it is recommended to update Chrome immediately.

This is done by loading chrome://settings/help in the browser’s address bar or selecting Menu > Help > About Google Chrome manually.

Chrome lists the installed version and will download a new version that it finds automatically on desktop systems.

Pro Tip: open a command prompt window on Windows and run winget upgrade google.chrome.exe to update Chrome without opening it.

Chrome should display one of the following versions after installation of the update:

  • Chrome for Mac or Windows: 125.0.6422.141 or 125.0.6422.142
  • Chrome for Linux: 125.0.6422.141
  • Chrome Extended Channel for Mac or Windows: 124.0.6367.243
  • Chrome for Android: 125.0.6422.146 or 125.0.6422.147

The security fixes

Google lists seven of the eleven security issues that it fixed in the Chrome update on the official releases site.

All seven have a severity rating of high. Google does not publish information about security issues that it discovered internally. The severity of the four unmentioned security issues is unknown as a consequence.

Here is what Google reveals about the listed security issues:

  • [$7000][339877165] High CVE-2024-5493: Heap buffer overflow in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2024-05-11
  • [TBD][338071106] High CVE-2024-5494: Use after free in Dawn. Reported by wgslfuzz on 2024-05-01
  • [TBD][338103465] High CVE-2024-5495: Use after free in Dawn. Reported by wgslfuzz on 2024-05-01
  • [TBD][338929744] High CVE-2024-5496: Use after free in Media Session. Reported by Cassidy Kim(@cassidy6564) on 2024-05-06
  • [TBD][339061099] High CVE-2024-5497: Out of bounds memory access in Keyboard Inputs. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2024-05-07
  • [TBD][339588211] High CVE-2024-5498: Use after free in Presentation API. Reported by anymous on 2024-05-09
  • [TBD][339877167] High CVE-2024-5499: Out of bounds write in Streams API. Reported by anonymous on 2024-05-11

The security issues affect several components of the browser, including APIs, keyboard inputs, media session, WebRTC, and Dawn. Dawn is an “open-source and cross-platform implementation of the WebGPU standard” according to Google Source.

Chrome

Chrome warning “These extensions may soon no longer be supported”

Posted on by Martin Brinkmann

Google is working on shutting down the old ruleset for Chrome browser extensions in favor of a new ruleset. The switch from Manifest V2 to Manifest V3 brings along with it a huge problem: extensions that are not updated will cease to work.

While no one has counted the extensions that rely on Manifest V2 in the Chrome Web Store, the count is likely in the thousands. Not all of the are actively maintained.

In addition, some extensions cannot be upgraded without loss of functionality. This is especially the case for content blockers.

Google, an advertising company first and foremost, does have a vetted interest in limiting content blockers. While there is no evidence that the company has made the decision to limit content blockers deliberately, it is clear that content blockers suffer under Manifest V3.

Chrome These extensions may soon no longer be supported

Soon, Chrome is warning users who have extensions installed that rely on Manifest V2. The browser lists extensions that won’t be supported by Chrome in the near future on the extensions page.

Google suggests to either remove the extensions entirely or to replace them with extensions from the Chrome Web Store that support Manifest V3.

Popular extensions such as uBlock Origin and even some of Google’s own are listed there as incompatible.

While there is a chance that some of these extensions will be updated to support Manifest V3, users of Chrome should not get their hopes up that this is the case for all extensions currently incompatible.

If you use Chrome, you can enable the deprecation warning right now in Chrome Canary.

  1. Load chrome://flags/#extension-manifest-v2-deprecation-warning in the Chrome address bar.
  2. Change the state to Enabled.
  3. Restart Google Chrome.
  4. Load chrome://extensions to see the list of unsupported extensions.

Google has revealed the following information about the deprecation of Manifest V2:

  • June 2024 — Manifest V2 extensions will be disabled in pre-stable versions of Chrome starting in Chrome 127. Manifest V2 extensions cannot be installed in Chrome anymore. Google will roll out the change gradually.
  • July 2024 or later — After monitoring the deprecation for at least a month, Google will roll out the deprecation to stable versions of Google Chrome.
  • June 2025 — Manifest V2 extensions cannot be installed anymore on Enterprise devices running Chrome.

The change will impact most Chromium-based browsers as well.

What about your extensions? Are some of them only available as Manifest V2 extensions?

AntennaPod interface

Podcast Player AntennaPod 3.4 launches with massive performance gains

Posted on by Martin Brinkmann

The end of Google’s Podcast application and the attempt to push users to the mediocre alternative YouTube Music has pushed some users to other podcasting apps.

AntennaPod is an open source podcast player and manager that is updated regularly. Core features include:

  • No ads.
  • Option to subscribe to podcasts using online podcast directories.
  • Download podcast episodes manually or automatically.
  • Modify settings per-podcast, e.g., playback speed or auto-skipping.
  • Supports authentication.
  • Lots of customization options.

AntennaPod 3.4.0

The latest update improved the application’s efficiency in several key areas. The developers note in the release note that this update completes the modernization of the apps’ code structure. The process began three years ago.

AntennaPod 3.4.0 improves the refreshing of subscriptions by up to three times compared to the previous performance. This improvement is especially noticeable if a user has subscribed to a lot of podcasts.

The release notes mention at least 1000 episodes. While that sounds like a lot, it depends on the subscribed podcasts.

The second improvement speeds up the deletion of podcasts subscription. This process is improved by up to the factor 10.

The new version includes other improvements:

  • An option to back up the database automatically is now available. You find it under Settings > Import/Export > Automatic database export. It saves the database every three days when activated and keeps the last 5 backups.
  • Add a sleep timer to AntennaPod notifications. This option is found under Settings > User Interface > Set notification buttons.
  • Skip Silence can now be configured per subscription.
  • An option to reorder sections on the homepage is now also available.

While there are other excellent apps out there, AntennaPod is certainly among them when it comes to functionality and the overall experience.

What about you? Do you listen to podcasts? If so, which app or service do you use?

O&O ShutUp10++ update

O&O ShutUp10++ update adds more privacy goodness

Posted on by Martin Brinkmann

The first O&O ShutUp10++ update for Windows 10 and 11 of 2024 is now available. It is an excellent privacy tool to improve privacy through an easy to use interface.

You can check out my full review of O&O ShutUp10++ for in-depth information.

O&O ShutUp10++ 1.9.1437

The new version of the free application is available already. It was released about a week ago. New and existing users may download it from the official project website.

The update introduces new privacy options and also quality of life improvements. As far as privacy options are concerned, here is what is new:

  • NEW: Disable remote assistance connections to this computer
  • NEW: Disable remote connections to this computer

You find these two new options under Local Machine > Miscellaneous at the very bottom of the page.

The remaining changes improve usability of the app. Whenever you make a change, you receive a prompt to create a system restore point. If the feature is disabled, O&O ShutUp10++ may now launch the Control Panel in this case to rectify this.

Existing users may also notice that the start of the app is faster than before.

The configuration file is saved to the start directory now, and it is automatically migrated from previous versions. The file is called OOSU10.cfg and you find it in the same directory that you run O&O ShutUp10++ from. This makes it easier to migrate the configuration to other systems.

The application supports making bulk changes. It distinguishes between recommended, somewhat recommended, and all settings. A click on any of those under Actions displays the number of changed preferences now.

Tip: while these actions sound useful, they are applied immediately. It is better to make changes manually instead.

  1. Select View > Group by Categories to disable the grouping of settings.
  2. Click on “recommended” in the table to sort by recommendation state.
  3. Go through the list from top to bottom and make the changes manually.

Closing Words

O&O ShutUP10++ is an excellent free application for Windows to improve user privacy on the system. It is updated frequently to introduce new privacy options, such as disabling Copilot.

Do you use privacy tweak tools or system optimization tools? Which do you use and prefer?

Microsoft Copilot Bot on Telegram

You can now chat with Microsoft Copilot on Telegram

Posted on by Martin Brinkmann

Microsoft has identified another service that its AI Copilot has not been available on. Today, Microsoft launched Copilot officially for the messaging service Telegram.

Word of warning: while you do not need a Microsoft account to communicate with the AI, it is necessary to part with your mobile phone number for verification purposes.

Here is how it works:

  1. Open the Telegram app and search for Microsoft Copilot, or, open the official Microsoft Copilot Telegram page here.
  2. Select I Accept when asked to do so to continue.
  3. Provide Copilot with the device’s phone number for verification.

Once that is out of the way, you may interact with Copilot using text messages or by selecting one of the displayed ideas.

Note: Copilot limits interactions to 30 per day. This is not much and there is no option currently to increase the limit.

The bot accepts a few commands:

  1. /restart to end the current chat and start over.
  2. /ideas to display examples.
  3. /share to get invites for friends.

The most important command is restart, as it erases the previous chat so that you can start a new one.

Interactions work as you expect them to work. Type a message and submit it to get an answer.

As is the case with all Copilot interactions, messages are send to Microsoft servers. They are processed there and then returned to Telegram.

The process was quick during tests. It is unclear whether that is going to change as the bot’s popularity may increase on the platform.

All in all, you do get the same experience that you get on other platforms that Copilot is available on. The experience is limited, because of the 30 chat turns limit and the inability to generate images at this point.

Verdict

Considering that you can interact with Copilot on other platforms as well, without handing over your phone number, most of you will probably shy away from the Telegram bot experience.

Have you interacted with Copilot or another AI before? Did you like it or find it useful?