They say they've secured it. But it's ripe for abuse. Apple users have been having abuse issues with it for years. A quick google shows tons of links of people complaining about push abuse and possible security concerns since at least 2011 and now FF is going to have it enabled by default.
Loverly.
If you're like me and you don't want a potential hole open in your system then when 44 hits your repo go to about
:config and set dom.push.enable to false.
https://wiki.mozilla.org/Firefox/Push_Notifications
