Replying to myself: ok so I just tried this and it's not that easy. The bootstrap script installed a bunch of dependencies but didn't install rust for some reason. Also Ubuntu 14.04 doesn't have the right version of gcc available so you have to get that basically too. The hg clone operation took forever and timed out a few times. Then my computer ran out of RAM during the build and I had to close some programs and start it up again. Pretty much a giant pain, and I don't even want to try Windows where the first step is "install Visual Studio"!

FWIW, on a fresh ubuntu 16.04 install, this is what needs to be run:

    sudo apt update && sudo apt install python build-essential -y
    wget -O bootstrap.py https://hg.mozilla.org/mozilla-central/raw-file/default/python/mozboot/bin/bootstrap.py && python bootstrap.py
    cd mozilla-unified/
    ./mach build

That takes care of rust too?

re: hg clone timeouts, you can download a leaner hg bundle over HTTP and then "unbundle" it:

https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...

mozilla-central is just such a big repository that it pushes the usual cloning process to its limits.

The Rust dependency was added to Firefox very recently, so I guess with the holidays it hasn't made it into the bootstrap script and docs yet.

*basically = manually

But I am not familiar enough with the firefox code to do this. I might unknowingly create a whole new set of security issues by changing a few lines in a project of this complexity.

FF you first start by looking at their long guide for version control/build instructions http://mozilla-version-control-tools.readthedocs.io/en/lates...

Then you make a custom mozconfig file to disable or enable features, or to add your own extensions (ie: windows): https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...

  ac_add_options --disable-activex  
  ac_add_options --disable-activex-scripting
  ac_add_options --disable-installer
  ac_add_options --disable-crashreporter

You can further abstract this with a mozconfig wrapper https://github.com/ahal/mozconfigwrapper

But I agree, I can't find any documentation what exactly every feature is and why you would not want to disable/enable them. The Chromium build process is much more straight forward, or you could just use 3rd party sandbox and regular release FF.

Your first link is misleading because it's targeted toward onboarding new Firefox contributors and includes a Mercurial tutorial and development workflow guide in addition to build instructions. Simple build instructions are here:

https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...

On Linux I clone the source and run "./mach build".

Forgot to add there's a really good page around by the Chrome security team detailing all kinds of functions somebody might wish to remove such as dns lookups that expose your IP (the tails/torbrowser design document also has this list)

do you have a link?

The suggestion is that you compile it with a flag to disable the feature. No need to change any lines of code.

I think their point is that they don't know enough about the innerworkings (read: code) to be sure that turning off one feature doesn't enable far more security vulnerabilities than existed when the feature was on...

They aren't suggesting using compile flags requires code changes...