Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
On a fresh network install of Debian 8.5 and first run of firefox-esr,
the following hosts were contacted:

tiles.services.mozilla.com
ocsp.digicert.com
location.services.mozilla.com
tiles-cloudfront.cdn.mozilla.net
www.mozilla.org
cdn.optimizely.com
vassg142.ocsp.omniroot.com
cdn3.optimizely.com
www.googletagmanager.com
accounts.firefox.com
snippets.cdn.mozilla.net
clients1.google.com
www.google.com
shavar.services.mozilla.com
www.google-analytics.com
tracking-protection.cdn.mozilla.net
stats.g.doubleclick.net
self-repair.mozilla.org

   * What exactly did you do (or not do) that was effective (or
     ineffective)?
Changing the home page will stop some of this behaviour.
"Tracking protection" and "safe browsing" are also responsible for some of the traffic although I'm not suggesting that should be disabled by default.
Not all of the features responsible can be disabled from the application's prefences, users should be able to make a choice rather than maybe later discovering their privacy is broken by an obscure setting in about:config

   * What was the outcome of this action?
Despair, Debian is the only OS I use which doesn't need modification to stop it making connections to the internet without an obvious user action. firefox-esr breaks this massively.

   * What outcome did you expect instead?
A default browser which in default settings doesn't start tracking activities with Google or anyone else before I've even loaded a page.

Dear Maintainer,
I used wireshark to find out as can be seen at
http://unix.stackexchange.com/questions/315315/how-to-get-list-of-sites-domains-linked-to-in-wireshark

and in a new profile in firefox 49.0 the situation doesn't seem to be
so dire, although have no idea where the 2000+ packets get sent in the
moment I put a fresh profile and have no add-ons on the browser.

Still I got the following domains to which firefox talks at booting
up/starting up .

vassg142.ocsp.omniroot.com  2
 ocsp.digicert.com           13
 clients1.google.com         3
  /ocsp                      3

The numbers are the count, guessing it's other cookies or whatever in
wireshark it means for count in requests.

the connections you found can be blocked by changing these
configuration directives:

browser.newtabpage.enabled
security.OCSP.enabled
browser.safebrowsing.enabled
browser.safebrowsing.malware.enabled
privacy.trackingprotection.pbmode.enabled
browser.search.suggest.enabled
browser.search.update
extensions.blocklist.enabled
extensions.update.enabled
extensions.getAddons.cache.enabled
datareporting.healthreport.service.enabled
toolkit.telemetry.enabled
network.http.speculative-parallel-limit

and may be:

beacon.enabled
browser.send_pings


from time to time I have collected a list of configuration directives
to stop automatic connections to remote hosts

you can find at http://www.trek.eu.org/text/firefox-tuning.html

I hope this can help

Why a non-private browsing? User activity should be assumed as private
by default.
Proposed defaults:

browser.newtabpage.directory.ping = ""
browser.newtabpage.directory.source = ""
captivedetect.canonicalURL = ""
app.update.url = ""
browser.safebrowsing.downloads.remote.url = ""
browser.safebrowsing.provider.google.gethashURL = ""
browser.safebrowsing.provider.google.reportURL = ""
browser.safebrowsing.provider.google.updateURL = ""
browser.safebrowsing.provider.google4.reportURL = ""
browser.safebrowsing.provider.google4.updateURL = ""
browser.safebrowsing.provider.mozilla.gethashURL = ""
browser.safebrowsing.provider.mozilla.updateURL = ""
browser.safebrowsing.reportMalwareMistakeURL = ""
browser.safebrowsing.reportPhishMistakeURL = ""
browser.safebrowsing.reportPhishURL = ""
browser.search.geoSpecificDefaults.url = ""
browser.search.geoip.url = ""
browser.tabs.crashReporting.sendReport = false
datareporting.healthreport.service.enabled = false
datareporting.healthreport.uploadEnabled = false
datareporting.policy.dataSubmissionEnabled = false
security.ssl.errorReporting.enabled = false
security.ssl.errorReporting.url = ""
security.ssl.errorReporting.automatic = ""
browser.startup.homepage = "https://start.duckduckgo.com/"
devtools.gcli.imgurUploadURL = ""
devtools.gcli.jquerySrc = ""
devtools.gcli.lodashSrc = ""
devtools.gcli.underscoreSrc = ""
devtools.webide.adaptersAddonURL = ""
devtools.webide.adbAddonURL = ""
devtools.webide.addonsURL = ""
devtools.webide.simulatorAddonsURL = ""
devtools.webide.templatesURL = ""
experiments.manifest.uri = ""
geo.wifi.uri = ""
identity.mobilepromo.android = ""
identity.mobilepromo.ios = ""
security.ssl.errorReporting.url = ""
toolkit.telemetry.server = ""
webextensions.storage.sync.enabled = false

 > Note: trek.eu.org link provided by Trek is not working.

	I’ve just checked and [1] does work for me.  (Note though that
	‘www’ has to be there.)  An archived copy [2] is also available.

[1] http://www.trek.eu.org/text/firefox-tuning.html
[2] https://web.archive.org/web/20170411151300/http://www.trek.eu.org/text/firefox-tuning.html

 > Why a non-private browsing?  User activity should be assumed as
 > private by default.

	Or at least there should be an easier (and more prominently
	presented) way for the user to opt out.

 > Proposed defaults:

 > browser.newtabpage.directory.ping = ""
 > browser.newtabpage.directory.source = ""

	Personally, I’ve disabled all the ‘safebrowsing’, ‘update’, and
	similar options I could find.  Also, just to be sure, I’ve
	uniformly replaced nearly every single URI in prefs.js like:

user_pref("browser.safebrowsing.provider.mozilla.updateURL", "http://browser.safebrowsing.provider.mozilla.updateurl.unwanted.nowhere.invalid/");

	Now I can refer to my HTTP proxy logs for the possible attempts
	to disclose my use of Firefox to third parties (like my ISP,
	employer, and whatever the entity it tries to connect to.)

	Which seem to be surprisingly few (and the last one below is due
	to xul-ext-noscript, not Firefox proper):

browser.newtabpage.directory.source
browser.safebrowsing.provider.mozilla.updateurl
browser.search.geoip.url
extensions.blocklist.url
noscript.abe.wanipcheckurl

	Can at least the ‘safebrowsing’ one please be fixed to respect
	the whatever ‘browser.safebrowsing.*.enabled = false’ setting
	applicable?  Can there be also options to cleanly disable the
	‘newtabpage.directory’ and ‘search.geoip’ functions as well?

	TIA.

 > captivedetect.canonicalURL = ""
 > app.update.url = ""
 > browser.safebrowsing.downloads.remote.url = ""

[…]

 > browser.safebrowsing.reportPhishURL = ""
 > browser.search.geoSpecificDefaults.url = ""
 > browser.search.geoip.url = ""

	I think it should also include browser.search.suggest.enabled =
	false, which appears rather important as “search suggestions”
	result in even the partial input being communicated to a remote
	party.  (Which may even be a genuinely sensitive information –
	like one’s password – by the way of pure accident.)

	It’s basically Firefox’ very own remote keyboard logger!

 > browser.tabs.crashReporting.sendReport = false
 > datareporting.healthreport.service.enabled = false
 > datareporting.healthreport.uploadEnabled = false
 > datareporting.policy.dataSubmissionEnabled = false
 > security.ssl.errorReporting.enabled = false
 > security.ssl.errorReporting.url = ""
 > security.ssl.errorReporting.automatic = ""
 > browser.startup.homepage = "https://start.duckduckgo.com/"

	I believe it should rather be about:blank, file:/, or something
	like that – not requiring any network access whatsoever.

 > devtools.gcli.imgurUploadURL = ""

[…]

 > devtools.webide.templatesURL = ""
 > experiments.manifest.uri = ""
 > geo.wifi.uri = ""
 > identity.mobilepromo.android = ""
 > identity.mobilepromo.ios = ""
 > security.ssl.errorReporting.url = ""
 > toolkit.telemetry.server = ""
 > webextensions.storage.sync.enabled = false